CVE-2025-71267: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-71267 is a Denial-of-Service vulnerability in the Linux kernel's ntfs3 filesystem driver caused by an infinite loop triggered by a malformed NTFS image with a zero-sized ATTR_LIST attribute. It was disclosed on March 18, 2026, and affects Linux kernel versions from 5.15 through multiple stable branches up to (but not including) the patched releases. Affected version ranges include 5.15.x before 5.15.202, 6.1.x before 6.1.165, 6.2–6.6.x before 6.6.128, 6.7–6.12.x before 6.12.75, 6.13–6.18.x before 6.18.16, and 6.19.x before 6.19.6. It carries a CVSS v3.1 base score of 5.5 (Medium) (Red Hat Advisory, Feedly).

The root cause is classified as CWE-835 (Loop with Unreachable Exit Condition / Infinite Loop). In ntfs_load_attr_list(), when processing a resident ATTR_LIST attribute with data_size set to zero, the function still allocates memory due to al_aligned(0). This creates an inconsistent state where ni->attr_list.size is zero but ni->attr_list.le is non-null. The function ni_enum_attr_ex then incorrectly assumes no attribute list exists and enumerates only the primary MFT record; upon finding ATTR_LIST, it reloads and restarts enumeration indefinitely, hanging the kernel thread and preventing the mount operation from completing. The fix adds a validation check to return -EINVAL when a zero-sized ATTR_LIST is detected, before any memory allocation occurs (Red Hat Advisory, Feedly).

Successful exploitation causes a kernel thread to hang indefinitely during an NTFS mount operation, resulting in a Denial-of-Service (DoS) condition that renders the affected system unresponsive. The impact is limited to availability — there is no confidentiality or integrity impact. The vulnerability is locally scoped and does not enable lateral movement or data exfiltration (Red Hat Advisory, Feedly).

Exploitation requires local access with low privileges — specifically, the ability to mount or trigger the mounting of a crafted NTFS image. No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation as of the time of disclosure. The EPSS score is approximately 0.024% (very low probability of exploitation in the near term), and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Red Hat Advisory, Feedly).

1. Prepare a malformed NTFS image: Craft an NTFS filesystem image containing a resident ATTR_LIST attribute with data_size set to zero using a hex editor or NTFS manipulation tool.
2. Gain local access: Obtain a local user account on a vulnerable Linux system (kernel versions 5.15–6.19 before the patched releases) with permission to mount filesystems (e.g., via udisks2, fuse, or direct mount privileges).
3. Mount the malicious image: Execute mount -t ntfs3 <malicious.img> /mnt/target or trigger automount of the crafted image (e.g., by inserting a USB drive with the malformed filesystem).
4. Trigger the infinite loop: The kernel's ntfs_load_attr_list() processes the zero-sized ATTR_LIST, allocates memory, and enters an infinite enumeration loop in ni_enum_attr_ex, hanging the kernel thread and causing the system to become unresponsive (Feedly).

• Logs: Kernel logs (dmesg or /var/log/kern.log) showing a mount operation for an NTFS filesystem that never completes; absence of mount success or failure messages after initiating an ntfs3 mount.
• Process: A kernel thread stuck in an uninterruptible sleep state (D state in ps aux) associated with an ntfs3 mount operation; kworker or mount-related processes consuming CPU indefinitely without progress.
• File System: Presence of a suspicious or externally supplied NTFS image file (.img, .iso, or raw block device) with an unusually small or zero-length ATTR_LIST attribute, detectable via NTFS forensic tools such as ntfsinfo or mmls.

Update the Linux kernel to a patched stable release: 5.15.202, 6.1.165, 6.6.128, 6.12.75, 6.18.16, or 6.19.6 (or later). Patches are available across multiple stable kernel branches via kernel.org. As a workaround, restrict local users from mounting untrusted NTFS images by enforcing mandatory access controls (e.g., SELinux or AppArmor policies), disabling the ntfs3 module (modprobe -r ntfs3), or configuring mount restrictions via udev rules or udisks2 policies to prevent arbitrary filesystem mounts (Red Hat Advisory, Feedly).