CVE-2025-68365: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-68365 is an uninitialized memory vulnerability in the Linux kernel's NTFS3 file system driver. The flaw exists in the __getname() function, which wraps kmem_cache_alloc() and allocates memory that is used before being properly cleared, leading to uninitialized values being read in ntfs_read_hdr() and bcmp(). It affects Linux kernel versions from 5.15 up to (but not including) 5.15.199, 5.16–6.1.x before 6.1.162, 6.2–6.6.x before 6.6.122, 6.7–6.12.x before 6.12.68, and 6.13–6.18.x before 6.18.2. The vulnerability was published on December 24, 2025, and carries a CVSS v3.1 base score of 5.5 (Medium) (Microsoft MSRC, Feedly).

The root cause is classified as CWE-908 (Use of Uninitialized Resource). Memory allocated via kmem_cache_alloc() through the __getname() wrapper in the NTFS3 driver is passed to ntfs_read_hdr() and bcmp() before being zeroed, causing KMSAN (Kernel Memory Sanitizer) to report uninitialized value reads. The fix replaces kmem_cache_alloc() with kmem_cache_zalloc(), which zero-initializes the allocated memory before use. Exploitation requires local access with low privileges and no user interaction, as the attacker must be able to trigger NTFS3 file system operations on a vulnerable kernel (Feedly, Kernel Patch).

Successful exploitation by a local low-privileged attacker can cause denial of service through system crashes or hangs due to unpredictable kernel behavior triggered by uninitialized memory reads. There is no confidentiality or integrity impact; the availability impact is rated High, meaning the system may become completely unresponsive when accessing NTFS3-mounted file systems. The vulnerability does not provide a path to privilege escalation or lateral movement based on current analysis (Feedly).

Apply the available kernel patches by upgrading to one of the following fixed versions depending on your current kernel branch: 5.15.199 or later, 6.1.162 or later, 6.6.122 or later, 6.12.68 or later, or 6.18.2 or later. Patches were released on February 26, 2026, across multiple stable kernel branches (commits: 192e8ce302f1, 7d52c592cf53, a58e29849aef, a8a3ca23bbd9, bdf38063fd15, f7728057220c). As a temporary workaround until patching is complete, restrict local user access to systems running vulnerable kernel versions and limit interaction with NTFS3-mounted file systems where possible (Kernel Patch, Microsoft MSRC, Feedly).

The vulnerability has been picked up by standard Linux distribution security channels, with Debian, Ubuntu (multiple USN advisories including USN-8162-1, USN-8177-1/2, USN-8180-1/2/4/5/6, USN-8183-1/2, USN-8186-1, USN-8188-1, USN-8245-1, USN-8257-1, USN-8275-1, USN-8278-1/2, USN-8289-1/2, USN-8296-1/2, USN-8297-1), SUSE, Amazon Linux, and Yocto Project all issuing advisories or security notices. No notable independent researcher commentary or significant social media discussion has been observed, consistent with the vulnerability's moderate severity and local-only attack vector (Ubuntu USN-8162-1, Debian LTS).