CVE-2025-71311: fs/ntfs3: Initialize new folios before use
In the Linux kernel, the following vulnerability has been resolved:
fs/ntfs3: Initialize new folios before use
KMSAN reports an uninitialized value in longestmatchstd(), invoked from ntfscompresswrite(). When new folios are allocated without being marked uptodate and nireadframe() is skipped because the caller expects the frame to be completely overwritten, some reserved folios may remain only partially filled, leaving the rest memory uninitialized.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
In fs/ntfs3, initialize new folios before use when they are allocated without being from ntfs_compress_write(); ensure reserved folios are fully initialized so no remaining memory is left uninitialized when ni_read_frame() is skipped.
Linux kernel (fs/ntfs3) Initialize new folios before use in ntfs_compress_write() = Initialize reserved folios before marking uptodate / before skipping ni_read_frame()
Event History
Frequently Asked Questions
What is the severity of CVE-2025-71311?
The severity of CVE-2025-71311 is high with a CVSS score of 8.2.
How do I fix CVE-2025-71311?
To fix CVE-2025-71311, you should update your Linux kernel to the latest version that addresses this vulnerability.
What type of systems are affected by CVE-2025-71311?
CVE-2025-71311 affects systems running the Linux kernel with the ntfs3 file system.
What are the potential impacts of CVE-2025-71311?
The potential impacts of CVE-2025-71311 include the possibility of using uninitialized memory, which can lead to data corruption.
Is CVE-2025-71311 being actively exploited?
As of now, there is no public information indicating that CVE-2025-71311 is being actively exploited in the wild.