CVE-2025-68728: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-68728 is a use of uninitialized memory vulnerability in the Linux kernel's NTFS3 filesystem driver, specifically in the mi_format_new function. The flaw was discovered and reported via syzkaller (Google's kernel fuzzer) and disclosed on December 24, 2025. It affects Linux kernel versions from the introduction of the NTFS3 driver (commit 4342306f0f0d5ff4315a204d315c1b51b914fca5) up to the patched releases in stable branches. No CVSS score has been officially assigned at this time, though the EPSS score is approximately 0.018% (Red Hat CVE, Feedly).

The root cause is a use of uninitialized memory (CWE-908) in the ntfs_get_bh() function within the NTFS3 driver. When sb_getblk() returns a buffer that is not marked as up-to-date, the driver fails to initialize or overwrite the buffer contents before marking it as up-to-date and adding it to the metadata index (mi) record. If this uninitialized buffer is subsequently loaded, it triggers a KMSAN (Kernel Memory Sanitizer) error, indicating that kernel code is operating on uninitialized data. The fix ensures the buffer is overwritten (zeroed or populated) before being marked up-to-date, preventing uninitialized data from propagating into the mi record (Red Hat CVE, ENISA EUVD).

Exploitation of this vulnerability could lead to kernel memory corruption due to uninitialized data being used in filesystem record handling, potentially causing system instability or crashes (denial of service). In more severe scenarios, an attacker with local access and the ability to mount or interact with NTFS3 filesystems could potentially leverage the uninitialized memory to influence kernel behavior in unpredictable ways, though no confirmed arbitrary code execution path has been demonstrated publicly. The confidentiality impact is limited, as the primary risk is availability and integrity of the kernel's filesystem handling (Red Hat CVE, Feedly).

Patches have been applied to multiple stable Linux kernel branches. Fixed versions include Linux kernel 6.12.63, 6.17.13, 6.18.2, and 6.19-rc1. Downstream distributions including Debian (linux 6.1.162-1), Ubuntu (USN-8179-1, USN-8184-1, USN-8185-1, USN-8203-1, USN-8258-1, USN-8260-1, USN-8265-1), Amazon Linux 2 (ALAS2KERNEL-5.15-2026-098), and SUSE have released updated packages. Users should update to the latest patched kernel version provided by their distribution. As a temporary workaround where patching is not immediately possible, restricting unprivileged access to NTFS3 filesystem mounting can reduce exposure (Red Hat CVE, Ubuntu USN-8179-1, Debian LTS).