CVE-2025-68369: ntfs3: init run lock for extend inode
In the Linux kernel, the following vulnerability has been resolved:
ntfs3: init run lock for extend inode
After setting the inode mode of $Extend to a regular file, executing the truncate system call will enter the dotruncate() routine, causing the runlock uninitialized error reported by syzbot.
Prior to patch 4e8011ffec79, if the inode mode of $Extend was not set to a regular file, the dotruncate() routine would not be entered.
Add the runlock initialization when loading $Extend.
syzbot reported: INFO: trying to register non-static key. Call Trace: dumpstacklvl+0x189/0x250 lib/dumpstack.c:120 assignlockkey+0x133/0x150 kernel/locking/lockdep.c:984 registerlockclass+0x105/0x320 kernel/locking/lockdep.c:1299 lockacquire+0x99/0xd20 kernel/locking/lockdep.c:5112 lockacquire+0x120/0x360 kernel/locking/lockdep.c:5868 downwrite+0x96/0x1f0 kernel/locking/rwsem.c:1590 ntfssetsize+0x140/0x200 fs/ntfs3/inode.c:860 ntfsextend+0x1d9/0x970 fs/ntfs3/file.c:387 ntfssetattr+0x2e8/0xbe0 fs/ntfs3/file.c:808
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.116-1Fixed in 7.2.15-1Fixed in 7.3.4-1 - Configuration
Initialize run_lock when loading the $Extend inode to prevent the uninitialized-lock error during truncate operations.
Linux ntfs3 run_lock = initialized
Event History
Frequently Asked Questions
What is the severity of CVE-2025-68369?
CVE-2025-68369 is considered a high-severity vulnerability due to its potential to cause system instability.
How do I fix CVE-2025-68369?
To fix CVE-2025-68369, you need to update the Linux kernel to a version that includes the patch for this vulnerability.
What software is affected by CVE-2025-68369?
CVE-2025-68369 affects the Linux kernel versions prior to 4e8011ffec79.
What type of vulnerability is CVE-2025-68369?
CVE-2025-68369 is an uninitialized memory access vulnerability in the Linux kernel's NTFS3 file system implementation.
What are the potential impacts of CVE-2025-68369?
The potential impacts of CVE-2025-68369 include system crashes and unintended behavior when truncating files.