CVE-2025-71267

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

fs: ntfs3: fix infinite loop triggered by zero-sized ATTR_LIST

We found an infinite loop bug in the ntfs3 file system that can lead to a

Denial-of-Service (DoS) condition.

A malformed NTFS image can cause an infinite loop when an ATTR_LIST attribute

indicates a zero data size while the driver allocates memory for it.

When ntfs_load_attr_list() processes a resident ATTR_LIST with data_size set

to zero, it still allocates memory because of al_aligned(0). This creates an

inconsistent state where ni->attr_list.size is zero, but ni->attr_list.le is

non-null. This causes ni_enum_attr_ex to incorrectly assume that no attribute

list exists and enumerates only the primary MFT record. When it finds

ATTR_LIST, the code reloads it and restarts the enumeration, repeating

indefinitely. The mount operation never completes, hanging the kernel thread.

This patch adds validation to ensure that data_size is non-zero before memory

al

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References