CVE-2025-71267
Analyzed Analyzed - Analysis Complete
Infinite Loop DoS in Linux Kernel ntfs3 Filesystem

Publication date: 2026-03-18

Last updated on: 2026-05-21

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: fs: ntfs3: fix infinite loop triggered by zero-sized ATTR_LIST We found an infinite loop bug in the ntfs3 file system that can lead to a Denial-of-Service (DoS) condition. A malformed NTFS image can cause an infinite loop when an ATTR_LIST attribute indicates a zero data size while the driver allocates memory for it. When ntfs_load_attr_list() processes a resident ATTR_LIST with data_size set to zero, it still allocates memory because of al_aligned(0). This creates an inconsistent state where ni->attr_list.size is zero, but ni->attr_list.le is non-null. This causes ni_enum_attr_ex to incorrectly assume that no attribute list exists and enumerates only the primary MFT record. When it finds ATTR_LIST, the code reloads it and restarts the enumeration, repeating indefinitely. The mount operation never completes, hanging the kernel thread. This patch adds validation to ensure that data_size is non-zero before memory allocation. When a zero-sized ATTR_LIST is detected, the function returns -EINVAL, preventing a DoS vulnerability.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-03-18
Last Modified
2026-05-21
Generated
2026-06-16
AI Q&A
2026-03-18
EPSS Evaluated
2026-06-15
NVD
CVE-2025-71267
EUVD
EUVD-2025-208821
Affected Vendors & Products
Showing 6 associated CPEs
Vendor Product Version / Range
linux linux_kernel From 6.2 (inc) to 6.6.128 (exc)
linux linux_kernel From 6.7 (inc) to 6.12.75 (exc)
linux linux_kernel From 6.13 (inc) to 6.18.16 (exc)
linux linux_kernel From 6.19 (inc) to 6.19.6 (exc)
linux linux_kernel From 5.16 (inc) to 6.1.165 (exc)
linux linux_kernel From 5.15 (inc) to 5.15.202 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-835 The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability exists in the Linux kernel's ntfs3 file system driver. It involves an infinite loop triggered by a zero-sized ATTR_LIST attribute in a malformed NTFS image.

When the ntfs_load_attr_list() function processes an ATTR_LIST attribute with a data size of zero, it still allocates memory due to a function call (al_aligned(0)). This leads to an inconsistent internal state where the attribute list size is zero but the attribute list pointer is non-null.

Because of this inconsistency, the enumeration function incorrectly assumes no attribute list exists and only processes the primary MFT record. When it encounters the ATTR_LIST again, it reloads and restarts enumeration indefinitely, causing an infinite loop.

This infinite loop causes the kernel thread handling the mount operation to hang, effectively causing a Denial-of-Service (DoS) condition.

The vulnerability was fixed by adding validation to ensure that the data size is non-zero before allocating memory. If a zero-sized ATTR_LIST is detected, the function returns an error (-EINVAL), preventing the infinite loop and DoS.

Impact Analysis

This vulnerability can lead to a Denial-of-Service (DoS) condition on systems using the Linux kernel's ntfs3 file system driver.

Specifically, if a malformed NTFS image containing a zero-sized ATTR_LIST attribute is processed, the kernel thread responsible for mounting the file system can enter an infinite loop and hang.

This means that the affected system could become unresponsive or unable to mount certain NTFS file systems, potentially disrupting normal operations and access to data.

Compliance Impact

I don't know

Detection Guidance

I don't know

Mitigation Strategies

To mitigate this vulnerability, update the Linux kernel to a version that includes the patch fixing the infinite loop in the ntfs3 file system.

The patch adds validation to ensure that zero-sized ATTR_LIST attributes do not cause memory allocation and infinite loops, preventing the Denial-of-Service condition.

Until the update is applied, avoid mounting potentially malformed NTFS images that could trigger this issue.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-71267. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart