CVE-2025-71266: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-71266 is a Denial-of-Service vulnerability in the Linux kernel's ntfs3 filesystem driver caused by an infinite loop during directory lookup operations. A malformed NTFS filesystem with a crafted dentry can trigger unbounded memory allocation, leading to memory exhaustion and an OOM kernel crash. The vulnerability was disclosed on March 18, 2026, and affects multiple Linux kernel stable branches. It carries a CVSS v3.1 base score of 5.5 (Medium), requiring only local access with low privileges (Red Hat CVE, Feedly).

The root cause is classified as CWE-835 (Loop with Unreachable Exit Condition / Infinite Loop). By setting the HAS_SUB_NODE flag in an INDEX_ENTRY within a directory's INDEX_ALLOCATION block and manipulating the Virtual Cluster Number (VCN) pointer, an attacker causes the indx_find() function to repeatedly read the same block, allocating approximately 4 KB of memory per iteration. The kernel's ntfs3 driver lacked VCN loop detection and depth limits, and critically, indx_find() did not check the return value of fnd_push(). The fix adds a return value check: when the index exceeds the size of the fnd->nodes array, fnd_push() returns -EINVAL, and indx_find() halts further processing (Red Hat CVE, Kernel Announce).

Successful exploitation results in complete loss of system availability through kernel memory exhaustion and an Out-of-Memory (OOM) crash, effectively causing a system-wide Denial of Service. There is no confidentiality or integrity impact. A local attacker with low privileges can crash the entire system by mounting or triggering lookup operations on a crafted NTFS filesystem, affecting all processes and users on the host (Red Hat CVE, Feedly).

1. Prepare a malicious NTFS image: Craft a malformed NTFS filesystem image where an INDEX_ENTRY within a directory's INDEX_ALLOCATION block has the HAS_SUB_NODE flag set and the VCN pointer manipulated to reference the same block repeatedly.
2. Mount the filesystem: As a low-privileged local user, mount the crafted NTFS image using the ntfs3 driver (e.g., mount -t ntfs3 malicious.img /mnt/target).
3. Trigger directory lookup: Perform a directory listing or file lookup operation within the mounted filesystem (e.g., ls /mnt/target/ or find /mnt/target/), causing the kernel to invoke indx_find().
4. Trigger infinite loop: The indx_find() function enters an infinite loop, repeatedly calling fnd_push() and allocating ~4 KB of kernel memory per iteration without bound.
5. Achieve DoS: The kernel exhausts available memory, triggering an OOM condition and crashing the system (Red Hat CVE, Kernel Announce).

• Logs: Kernel OOM killer messages in /var/log/kern.log or dmesg output showing rapid memory exhaustion; repeated kernel warnings or stack traces referencing ntfs3, indx_find, or fnd_push functions.
• Process/System: Sudden system freeze or reboot; dmesg output showing ntfs3 filesystem mount events followed by OOM kill events; unusually high kernel memory consumption visible via /proc/meminfo before crash.
• File System: Presence of unusual or externally supplied NTFS filesystem images (.img, .ntfs) in user-accessible directories; unexpected mount entries for ntfs3 filesystems in /proc/mounts.

Apply kernel updates to the following fixed versions: 5.15.202, 6.1.165, 6.6.128, 6.12.75, 6.18.16, or 6.19.6. Distribution-specific updates are available from Red Hat, Debian (DSA-6238, DSA-6243, DLA-4561), Amazon Linux (AL2 ALAS2KERNEL-5.15-2026-099/100, AL2023 ALAS2023-2026-1543/1702), and Microsoft Azure Linux. As a workaround prior to patching, restrict or disable mounting of untrusted NTFS filesystems, or disable the ntfs3 kernel module (modprobe -r ntfs3) if NTFS support is not required (Red Hat CVE, Amazon Linux AL2, Debian DSA-6238).