CVE-2025-71067: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-71067 is a vulnerability in the Linux kernel's NTFS3 filesystem driver where sb->s_blocksize is used without being properly defined or validated during the mount process. When a block device has a block size greater than PAGE_SIZE (e.g., 16384 bytes), sb_set_blocksize() leaves sb->s_blocksize at zero; subsequently, ntfs_init_from_boot() attempts to read the boot block with this zero blocksize, triggering a kernel bug. The vulnerability was published on January 13, 2026, and affects the Linux kernel across multiple stable branches. No CVSS score has been assigned by NVD at this time; the EPSS score is approximately 0.018% (Feedly, kernel.org).

The root cause is an uninitialized variable condition (related to CWE-457, Use of Uninitialized Variable) in the NTFS3 driver's mount path. During mount, get_tree_bdev_flags() calls sb_set_blocksize(sb, block_size(bdev)), but when block_size(bdev) > PAGE_SIZE, sb_set_blocksize() fails silently and leaves sb->s_blocksize at zero. The subsequent call to ntfs_init_from_boot() then attempts a block read using this zero blocksize, triggering the bug. The fix sets a dummy blocksize before attempting to read the boot block, and adds proper return value handling. A syzkaller reproducer is publicly documented in the CVE description, involving ioctl$FS_IOC_SETFLAGS to set the bdev block size to 16384 before mounting an NTFS3 filesystem (Feedly, kernel.org).

Successful exploitation can cause a kernel panic or system instability, resulting in a denial of service for the affected host. The vulnerability requires local access to mount filesystems and manipulate block device parameters via ioctl, limiting its scope to local attackers with sufficient privileges. There is no evidence of confidentiality or integrity impact; the primary risk is availability loss through a kernel crash (Feedly).

No public proof-of-concept exploit or evidence of in-the-wild exploitation has been observed as of the time of this report. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.018%, reflecting a very low probability of exploitation in the near term. Exploitation requires local access to mount filesystems and the ability to manipulate block device parameters, which significantly limits the attacker surface (Feedly).

1. Gain local access: Obtain a local user account on a Linux system running a vulnerable kernel version with NTFS3 support enabled and sufficient privileges to perform mount operations and ioctl calls.
2. Create a null block device: Use openat$nullb to open a null block device (e.g., /dev/nullb0).
3. Set oversized block size: Issue ioctl$FS_IOC_SETFLAGS with the value 0x4000 (16384) to set the block device's block size to 16384 bytes, which exceeds PAGE_SIZE.
4. Mount NTFS3 filesystem: Attempt to mount the null block device as an NTFS3 filesystem (e.g., mount(@nullb, './cgroup', 'ntfs3', flags, NULL)). During mount, sb_set_blocksize() fails to set sb->s_blocksize because the block size exceeds PAGE_SIZE, leaving it at zero.
5. Trigger kernel bug: The kernel's ntfs_init_from_boot() function attempts to read the boot block using the zero blocksize, triggering a kernel panic or system crash (Feedly).

• Logs: Kernel oops or panic messages in /var/log/kern.log or dmesg output referencing ntfs_init_from_boot() or NTFS3 mount failures with zero blocksize.
• Logs: Unexpected system reboots or kernel crash dumps (kdump) coinciding with NTFS3 mount attempts.
• Process: Unusual use of ioctl with FS_IOC_SETFLAGS on block devices followed immediately by NTFS3 mount syscalls, visible in auditd logs or strace output.
• File System: Presence of syzkaller-style reproducer scripts or automated fuzzing artifacts on the system.

The vulnerability has been patched in the following Linux kernel versions: 6.6.120, 6.12.64, 6.18.3, and 6.19-rc1. Administrators should update to one of these patched versions as the primary remediation. As a workaround, restrict unprivileged users from mounting filesystems and manipulating block device parameters via ioctl (e.g., using user namespace restrictions or disabling CAP_SYS_ADMIN for untrusted users). Ubuntu has issued security notices USN-8177-1, USN-8177-2, USN-8183-1, USN-8183-2, USN-8245-1, and USN-8257-1 addressing this issue (Ubuntu USN-8177-1, Ubuntu USN-8183-1, Feedly).