CVE-2025-68365 fs/ntfs3: Initialize allocated memory before use
An attacker can read uninitialized kernel memory via the NTFS3 filesystem driver due to missing initialization, potentially exposing sensitive data.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-68365?
CVE-2025-68365 is a high-severity vulnerability in Linux kernel, published on 24 Dec 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
fs/ntfs3: Initialize allocated memory before use
KMSAN reports: Multiple uninitialized values detected:
- KMSAN: uninit-value in ntfs_read_hdr (3) - KMSAN: uninit-value in bcmp (3)
Memory is allocated by __getname(), which is a wrapper for kmem_cache_alloc(). This memory is used before being properly cleared. Change kmem_cache_alloc() to kmem_cache_zalloc() to properly allocate and clear memory before use.
Weakness: CWE-908
Which versions are affected by CVE-2025-68365?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2025-68365?
Apply the vendor's patch.
Is CVE-2025-68365 being exploited?
There is no known exploitation of CVE-2025-68365 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-78410, BELL-CVE-2025-68365, DEBIAN-CVE-2025-68365, GHSA-g737-8242-62f7, ROOT-OS-DEBIAN-12-CVE-2025-68365, ROOT-OS-DEBIAN-13-CVE-2025-68365 and 3 more.