CVE-2025-68369: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-68369 is a Linux kernel vulnerability in the ntfs3 filesystem driver caused by an uninitialized run_lock for the $Extend inode. When the inode mode of $Extend is set to a regular file and the truncate system call is subsequently invoked, the kernel enters the do_truncate() routine and attempts to acquire an uninitialized read-write semaphore (run_lock), triggering a lockdep error. The vulnerability was introduced by patch 4e8011ffec79 and was reported by syzbot. It affects the Linux kernel across multiple stable branches, with fixes available in versions 6.12.63, 6.17.13, 6.18.2, and 6.19-rc1. A CVSS base score has not been formally assigned (reported as 0.0), and the EPSS score is approximately 0.018% (Feedly).

The root cause is an improper initialization of a synchronization primitive (CWE-909: Missing Initialization of Resource) in the ntfs3 filesystem driver (fs/ntfs3/). Specifically, when the $Extend metadata inode is loaded, its run_lock read-write semaphore is not initialized via init_rwsem(). If an attacker or user subsequently causes the inode mode of $Extend to be treated as a regular file and then calls truncate(), the kernel path ntfs_setattr() → ntfs_extend() → ntfs_set_size() attempts a down_write() on the uninitialized run_lock, resulting in a lockdep warning (INFO: trying to register non-static key). The fix adds run_lock initialization during the loading of the $Extend inode. Exploitation requires local access and the ability to mount or interact with an NTFS filesystem (Feedly).

Successful triggering of this vulnerability causes a kernel-level error due to use of an uninitialized lock, which can result in system instability or a kernel panic, impacting availability. The vulnerability is local in nature and primarily affects systems that mount NTFS3 filesystems (e.g., Linux systems with ntfs3 driver enabled). There is no evidence of confidentiality or integrity impact beyond the potential for a denial-of-service condition through kernel crash (Feedly).

There is no known public exploit code or evidence of in-the-wild exploitation for CVE-2025-68369. The vulnerability was discovered and reported by syzbot (Google's automated kernel fuzzer), indicating it was found through fuzzing rather than active exploitation. The EPSS score is approximately 0.018%, reflecting a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Feedly).

The Linux kernel maintainers have released patches addressing this vulnerability across multiple stable branches. Fixed versions include Linux 6.12.63, 6.17.13, 6.18.2, and 6.19-rc1. Downstream distributions including Debian (linux 6.1.162-1 via DLA-4476-1) and Ubuntu (USN-8179-1, USN-8179-2, USN-8179-3, USN-8179-4, USN-8184-1, USN-8185-1, USN-8185-2, USN-8203-1, USN-8258-1, USN-8260-1, USN-8265-1) have issued updated kernel packages. Users should update to the latest patched kernel version for their distribution. As a temporary workaround, avoiding the mounting of untrusted NTFS filesystems or disabling the ntfs3 driver can reduce exposure (Feedly, Debian LTS, Ubuntu USN-8179-1).

The vulnerability was identified by syzbot, Google's automated kernel fuzzing infrastructure, and reported to the Linux kernel security team. Downstream Linux distributions including Debian and Ubuntu have issued security advisories and updated kernel packages. No notable independent researcher commentary or significant social media discussion has been observed beyond standard distribution security notices (Feedly).