CVE-2025-68727
Uninitialized Buffer Vulnerability in Linux Kernel ntfs3 Module
Publication date: 2025-12-24
Last updated on: 2025-12-24
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability in the Linux kernel's ntfs3 module involves an uninitialized buffer allocated by the function __getname(). The issue was that after allocating a buffer for 'de', the buffer was not properly initialized, leading to uninitialized errors. The fix involved initializing the buffer with zeroes to prevent these errors. The problem was detected using Kernel Memory Sanitizer (KMSAN).
How can this vulnerability impact me? :
The impact of this vulnerability could include potential memory corruption or leakage of uninitialized memory contents, which might lead to system instability or security risks such as information disclosure. However, specific impacts are not detailed in the provided information.