CVE-2025-71265: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-71265 is an infinite loop vulnerability in the Linux kernel's ntfs3 file system driver that can cause a Denial-of-Service (DoS) condition. It affects Linux kernel versions from 5.15 through 6.19, with fixed versions at 5.15.202, 6.1.165, 6.6.128, 6.12.75, 6.18.16, and 6.19.6. The vulnerability was disclosed on March 18, 2026, and has a CVSS v3.1 base score of 5.5 (Medium) (Red Hat, Microsoft MSRC).

The root cause is classified as CWE-835 (Loop with Unreachable Exit Condition / Infinite Loop) in the attr_load_runs_range() function of the ntfs3 driver (Red Hat). When a malformed NTFS image contains an attribute header with evcn=-1 and svcn=0 (a valid representation of an empty run list), run_unpack() returns success immediately without initializing the runs_tree. The caller attr_load_runs_range() then assumes runs were loaded, sets clen to 0, and enters an infinite loop because run_lookup_entry() repeatedly fails while vcn is incremented by zero. The fix adds a retry counter to detect consecutive failures of run_lookup_entry() after attr_load_runs_vcn() and breaks out of the loop (Kernel Patches).

Successful exploitation causes the Linux kernel to hang in an infinite loop, rendering the affected system completely unresponsive and effectively denying service to all users (Red Hat). The impact is limited to availability — there is no confidentiality or integrity impact. A local attacker with low privileges can trigger this condition by mounting or accessing a crafted malformed NTFS image, potentially affecting any system where unprivileged users can mount file systems.

1. Prepare a malformed NTFS image: Craft an NTFS disk image where an attribute header is set with evcn=-1 and svcn=0 (indicating an empty run list), while directory entries reference that attribute as containing actual data, creating a metadata inconsistency.
2. Gain local access: Obtain a low-privileged local user account on a target Linux system running a vulnerable kernel version (5.15.x before 5.15.202, 6.1.x before 6.1.165, 6.2.x–6.6.x before 6.6.128, 6.7.x–6.12.x before 6.12.75, 6.13.x–6.18.x before 6.18.16, or 6.19.x before 6.19.6).
3. Mount the malformed image: Use a command such as mount -t ntfs3 malformed.img /mnt/target (or trigger auto-mount if user-mountable file systems are permitted) to load the crafted NTFS image via the ntfs3 driver.
4. Trigger the infinite loop: Access the file system (e.g., ls /mnt/target) to cause the kernel to parse the inconsistent metadata, triggering attr_load_runs_range() to enter an infinite loop where run_lookup_entry() repeatedly fails and vcn is never incremented.
5. Achieve DoS: The kernel hangs in the infinite loop, causing the system to become unresponsive and denying service to all users (Red Hat).

• Logs: Kernel logs (dmesg or /var/log/kern.log) showing ntfs3-related messages or warnings immediately before system hang; absence of new log entries after a mount operation may indicate a kernel freeze.
• Process: A kernel thread stuck in attr_load_runs_range() or related ntfs3 functions, observable via perf top, sysrq traces, or kernel stack dumps showing repeated calls to run_lookup_entry().
• File System: Presence of unusual or externally supplied NTFS image files (.img, .iso, .vhd) in user-accessible directories, particularly those with anomalous attribute metadata.
• System Behavior: Sudden and complete system unresponsiveness following an NTFS mount operation by a low-privileged user, with no recovery without a hard reboot.

Update the Linux kernel to a patched stable version: 5.15.202, 6.1.165, 6.6.128, 6.12.75, 6.18.16, or 6.19.6 (Red Hat, Kernel Patches). As an immediate workaround, restrict mounting of NTFS file systems to trusted sources only, disable the ntfs3 kernel module if it is not required (modprobe -r ntfs3), and remove user permissions to mount arbitrary file systems. Validate NTFS image integrity before mounting in environments where user-supplied images are processed. Amazon Linux 2 and Amazon Linux 2023 users should apply the respective ALAS advisories (AWS AL2 Advisory).

Red Hat has acknowledged the vulnerability and published a security advisory tracking it (Red Hat). Microsoft has also referenced the CVE in its Security Response Center update guide in the context of the Azure Linux kernel (Microsoft MSRC). Debian has issued multiple security advisories (DSA-6238, DSA-6243, DLA-4561) addressing this and related kernel vulnerabilities. No significant social media discussion or notable independent researcher commentary has been identified for this vulnerability.