PT-2026-26044 · Linux · Linux

Published 2026-03-18 · Updated 2026-03-18 · CVE-2025-71267

Mitre

In the Linux kernel, the following vulnerability has been resolved:

fs: ntfs3: fix infinite loop triggered by zero-sized ATTR LIST

We found an infinite loop bug in the ntfs3 file system that can lead to a Denial-of-Service (DoS) condition.

A malformed NTFS image can cause an infinite loop when an ATTR LIST attribute indicates a zero data size while the driver allocates memory for it.

When ntfs load attr list() processes a resident ATTR LIST with data size set to zero, it still allocates memory because of al aligned(0). This creates an inconsistent state where ni->attr list.size is zero, but ni->attr list.le is non-null. This causes ni enum attr ex to incorrectly assume that no attribute list exists and enumerates only the primary MFT record. When it finds ATTR LIST, the code reloads it and restarts the enumeration, repeating indefinitely. The mount operation never completes, hanging the kernel thread.

This patch adds validation to ensure that data size is non-zero before memory allocation. When a zero-sized ATTR LIST is detected, the function returns -EINVAL, preventing a DoS vulnerability.

Related Identifiers

CVE-2025-71267

Affected Products

Linux

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2025-71267 · Security Note
• https://git.kernel.org/stable/c/9267d99fade76d44d4a133599524031fe684156e · Note
• https://git.kernel.org/stable/c/8d8c70b57dbeda3eb165c0940b97e85373ca9354 · Note
• https://git.kernel.org/stable/c/7ef219656febf5ae06ae56b1fce47ebd05f92b68 · Note
• https://git.kernel.org/stable/c/976e6a7c51fabf150478decbe8ef5d9a26039b7c · Note
• https://git.kernel.org/stable/c/9779a6eaaabdf47aa57910d352b398ad742e6a5f · Note
• https://git.kernel.org/stable/c/06909b2549d631a47fcda249d34be26f7ca1711d · Note
• https://git.kernel.org/stable/c/fd508939dbca5eceefb2d0c2564beb15469572f2 · Note