CVE-2025-68727 ntfs3: Fix uninit buffer allocated by __getname()
An attacker with local access can read uninitialized kernel memory via the ntfs3 filesystem driver, potentially exposing sensitive data.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-68727?
CVE-2025-68727 is a vulnerability in Linux, published on 24 Dec 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
ntfs3: Fix uninit buffer allocated by __getname()
Fix uninit errors caused after buffer allocation given to 'de'; by initializing the buffer with zeroes. The fix was found by using KMSAN.
Which versions are affected by CVE-2025-68727?
How do I fix CVE-2025-68727?
Apply the vendor's patch.
Is CVE-2025-68727 being exploited?
There is no known exploitation of CVE-2025-68727 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2025-68727, DEBIAN-CVE-2025-68727, GHSA-c243-x575-hcmp, ROOT-OS-DEBIAN-12-CVE-2025-68727, ROOT-OS-DEBIAN-13-CVE-2025-68727, ROOT-OS-UBUNTU-2204-CVE-2025-68727 and 2 more.