CVE-2025-68728: ntfs3: fix uninit memory after failed mi_read in mi_format_new
In the Linux kernel, the following vulnerability has been resolved:
ntfs3: fix uninit memory after failed miread in miformatnew
Fix a KMSAN un-init bug found by syzkaller.
ntfsgetbh() expects a buffer from sbgetblk(), that buffer may not be uptodate. We do not bring the buffer uptodate before setting it as uptodate. If the buffer were to not be uptodate, it could mean adding a buffer with un-init data to the mi record. Attempting to load that record will trigger KMSAN.
Avoid this by setting the buffer as uptodate, if it’s not already, by overwriting it.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-68728?
CVE-2025-68728 is categorized as a moderate severity vulnerability in the Linux kernel.
How do I fix CVE-2025-68728?
To fix CVE-2025-68728, ensure that you update your Linux kernel to the latest patched version.
What are the potential impacts of CVE-2025-68728?
The impact of CVE-2025-68728 includes possible uninitialized memory access which could lead to information leaks.
Which versions of Linux kernel are affected by CVE-2025-68728?
CVE-2025-68728 affects specific versions of the Linux kernel that incorporate the NTFS3 driver.
Has CVE-2025-68728 been resolved?
Yes, CVE-2025-68728 has been resolved with a patch provided in the latest Linux kernel updates.