CVE-2025-71267 fs: ntfs3: fix infinite loop triggered by zero-sized ATTR_LIST

What is CVE-2025-71267?

CVE-2025-71267 is a medium-severity denial of service vulnerability in Linux kernel, published on 18 Mar 2026. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

In the Linux kernel, the following vulnerability has been resolved:

fs: ntfs3: fix infinite loop triggered by zero-sized ATTR_LIST

We found an infinite loop bug in the ntfs3 file system that can lead to a Denial-of-Service (DoS) condition.

A malformed NTFS image can cause an infinite loop when an ATTR_LIST attribute indicates a zero data size while the driver allocates memory for it.

When ntfs_load_attr_list() processes a resident ATTR_LIST with data_size set to zero, it still allocates memory because of al_aligned(0). This creates an inconsistent state where ni->attr_list.size is zero, but ni->attr_list.le is non-null. This causes ni_enum_attr_ex to incorrectly assume that no attribute list exists and enumerates only the primary MFT record. When it finds ATTR_LIST, the code reloads it and restarts the enumeration, repeating indefinitely. The mount operation never completes, hanging the kernel thread.

This patch adds validation to ensure that data_size is non-zero before memory allocation. When a zero-sized ATTR_LIST is detected, the function returns -EINVAL, preventing a DoS vulnerability.

Weakness: CWE-835

Which versions are affected by CVE-2025-71267?

It affects 1 product.

Products include Linux kernel.

How do I fix CVE-2025-71267?

Apply the vendor's patch.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2025-71267 being exploited?

There is no known exploitation of CVE-2025-71267 in the wild and no public exploit code.

Other vulnerabilities in Linux kernel

• CVE-2026-53266 Linux Kernel Out-of-Bounds Write Exploited High 8.8
• CVE-2013-6282 Linux Kernel Improper Input Validation Exploited High 8.8
• CVE-2022-0185 Linux Kernel Heap-Based Buffer Overflow Exploited High 8.4
• CVE-2013-2094 Linux Kernel Privilege Escalation Exploited High 8.4
• CVE-2026-53362 Linux Kernel Unspecified Exploited High 7.8

All Linux kernel vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as AZL-79992, BELL-CVE-2025-71267, DEBIAN-CVE-2025-71267, GHSA-j72w-3754-92gg, ROOT-OS-DEBIAN-12-CVE-2025-71267, ROOT-OS-DEBIAN-13-CVE-2025-71267 and 3 more.