NTFS3 File Truncation Error Leading to Inconsistent State

Publication date: 2026-05-06

Last updated on: 2026-06-01

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: handle attr_set_size() errors when truncating files If attr_set_size() fails while truncating down, the error is silently ignored and the inode may be left in an inconsistent state.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-05-06

Last Modified

2026-06-01

Generated

2026-07-06

AI Q&A

2026-05-06

EPSS Evaluated

2026-07-05

NVD

CVE-2025-71289

EUVD

EUVD-2025-209678

Affected Vendors & Products

Vendor	Product	Version / Range
linux_kernel	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability exists in the Linux kernel's NTFS3 file system driver. Specifically, when the function attr_set_size() fails during the truncation (shrinking) of files, the error is silently ignored. As a result, the inode, which is a data structure representing the file, may be left in an inconsistent or corrupted state.

Impact Analysis

If attr_set_size() fails and the error is ignored, the file system's metadata (inode) may become inconsistent. This can lead to file corruption or data loss because the file size and its actual data may no longer be properly synchronized.

Hi! I’m here to help you understand CVE-2025-71289. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70