CVE-2025-71265

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

fs: ntfs3: fix infinite loop in attr_load_runs_range on inconsistent metadata

We found an infinite loop bug in the ntfs3 file system that can lead to a

Denial-of-Service (DoS) condition.

A malformed NTFS image can cause an infinite loop when an attribute header

indicates an empty run list, while directory entries reference it as

containing actual data. In NTFS, setting evcn=-1 with svcn=0 is a valid way

to represent an empty run list, and run_unpack() correctly handles this by

checking if evcn + 1 equals svcn and returning early without parsing any run

data. However, this creates a problem when there is metadata inconsistency,

where the attribute header claims to be empty (evcn=-1) but the caller

expects to read actual data. When run_unpack() immediately returns success

upon seeing this condition, it leaves the runs_tree uninitialized with

run->runs as a NULL. The calling function attr_load_runs_range() assumes

that

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References