CVE-2025-71266 fs: ntfs3: check return value of indx_find to avoid infinite loop
A malformed NTFS3 filesystem image can cause an infinite loop and memory exhaustion in the Linux kernel, leading to a system crash.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-71266?
CVE-2025-71266 is a medium-severity denial of service vulnerability in Linux kernel, published on 18 Mar 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
fs: ntfs3: check return value of indx_find to avoid infinite loop
We found an infinite loop bug in the ntfs3 file system that can lead to a Denial-of-Service (DoS) condition.
A malformed dentry in the ntfs3 filesystem can cause the kernel to hang during the lookup operations. By setting the HAS_SUB_NODE flag in an INDEX_ENTRY within a directory's INDEX_ALLOCATION block and manipulating the VCN pointer, an attacker can cause the indx_find() function to repeatedly read the same block, allocating 4 KB of memory each time. The kernel lacks VCN loop detection and depth limits, causing memory exhaustion and an OOM crash.
This patch adds a return value check for fnd_push() to prevent a memory exhaustion vulnerability caused by infinite loops. When the index exceeds the size of the fnd->nodes array, fnd_push() returns -EINVAL. The indx_find() function checks this return value and stops processing, preventing further memory allocation.
Weakness: CWE-835
Which versions are affected by CVE-2025-71266?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2025-71266?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2025-71266 being exploited?
There is no known exploitation of CVE-2025-71266 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-79989, BELL-CVE-2025-71266, DEBIAN-CVE-2025-71266, GHSA-f43g-cfgj-442p, ROOT-OS-DEBIAN-12-CVE-2025-71266, ROOT-OS-DEBIAN-13-CVE-2025-71266 and 3 more.