CVE-2025-37806
MediumCVSS 5.5Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
In the Linux kernel, the ntfs3 filesystem lacks synchronization between write operations and ioctl calls that clear the file's compression flag. If a user clears the compression flag during a write, the kernel selects incorrect operations and triggers a NULL pointer dereference, causing a kernel oops.
Risk Assessment
A local user can crash the kernel (denial of service) by concurrently issuing a write and an ioctl on a file in an ntfs3 filesystem. This can destabilize the system or be exploited for a DoS attack.
Recommendation
Update the Linux kernel to a version containing the fix for CVE-2025-37806. Until then, avoid mounting untrusted ntfs3 filesystems or restrict the ability to perform ioctl on ntfs3 files.
Other vulnerabilities in Linux kernel (ntfs3)
See all- CVE-2026-90048Critical
In the Linux kernel, ni_create_attr_list() in the ntfs3 filesystem has a slab-out-of-bounds write. The function allocates a fixed buffer of record_size bytes and writes one ATTR_LIST_ENTRY per attribute without checking the buffer end. A crafted NTFS image with many minimum-size nameless attributes can overflow the heap buffer.
- CVE-2026-99171Low risk· EPSS 7%
A use-after-free vulnerability exists in the Linux kernel's ntfs3 module. When the "nocase" mount option is used, dentry compare and hash functions access superblock private data in the RCU pathwalk, while ntfs_put_super() and ntfs3_kill_sb() free that data without an RCU delay. A lookup still inside the filesystem when the last mount reference is dropped causes a UAF.
- CVE-2026-98539Low risk· EPSS 10%
In the Linux kernel's ntfs3 filesystem, ntfs_create_inode() called d_instantiate() before unlock_new_inode(), causing a race between directory creation and mounting a filesystem on the same path. This reset the i_rwsem lock state (count and owner) while another thread already held it, triggering warnings in do_new_mount and potentially causing inode_lock() to hang indefinitely. The fix switches to d_instantiate_new() and removes the trailing unlock_new_inode().
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Keep write operations atomic syzbot reported a NULL pointer dereference in __generic_file_write_iter. [1] Before the write operation is completed, the user executes ioctl[2] to clear the compress flag of the file, which causes the is_compressed() judgment to return 0, further causing the program to enter the wrong process and call the wrong ops ntfs_aops_cmpr, which triggers the null pointer dereference of write_begin. Use inode lock to synchronize ioctl and write to avoid this case. [1] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000 Mem abort info: ESR = 0x0000000086000006 EC = 0x21: IABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 FSC = 0x06: level 2 translation fault user pgtable: 4k pages, 48-bit VAs, pgdp=000000011896d000 [0000000000000000] pgd=0800000118b44403, p4d=0800000118b44403, pud=0800000117517403, pmd=0000000000000000 Internal error: Oops: 0000000086000006 [#1] PREEMPT SMP Modules linked in: CPU: 0 UID: 0 PID: 6427 Comm: syz-executor347 Not tainted 6.13.0-rc3-syzkaller-g573067a5a685 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : 0x0 lr : generic_perform_write+0x29c/0x868 mm/filemap.c:4055 sp : ffff80009d4978a0 x29: ffff80009d4979c0 x28: dfff800000000000 x27: ffff80009d497bc8 x26: 0000000000000000 x25: ffff80009d497960 x24: ffff80008ba71c68 x23: 0000000000000000 x22: ffff0000c655dac0 x21: 0000000000001000 x20: 000000000000000c x19: 1ffff00013a92f2c x18: ffff0000e183aa1c x17: 0004060000000014 x16: ffff800083275834 x15: 0000000000000001 x14: 0000000000000000 x13: 0000000000000001 x12: ffff0000c655dac0 x11: 0000000000ff0100 x10: 0000000000ff0100 x9 : 0000000000000000 x8 : 0000000000000000 x7 : 0000000000000000 x6 : 0000000000000000 x5 : ffff80009d497980 x4 : ffff80009d497960 x3 : 0000000000001000 x2 : 0000000000000000 x1 : ffff0000e183a928 x0 : ffff0000d60b0fc0 Call trace: 0x0 (P) __generic_file_write_iter+0xfc/0x204 mm/filemap.c:4156 ntfs_file_write_iter+0x54c/0x630 fs/ntfs3/file.c:1267 new_sync_write fs/read_write.c:586 [inline] vfs_write+0x920/0xcf4 fs/read_write.c:679 ksys_write+0x15c/0x26c fs/read_write.c:731 __do_sys_write fs/read_write.c:742 [inline] __se_sys_write fs/read_write.c:739 [inline] __arm64_sys_write+0x7c/0x90 fs/read_write.c:739 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline] invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:49 el0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:132 do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:151 el0_svc+0x54/0x168 arch/arm64/kernel/entry-common.c:744 el0t_64_sync_handler+0x84/0x108 arch/arm64/kernel/entry-common.c:762 [2] ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f00000000c0)=0x20)
Vulnerability data from NVD (NIST) · CISA KEV · EPSS