CVE-2025-68369

Root

Cause

The vulnerability resides in the ntfs3 filesystem driver. When the $Extend inode's mode is set to a regular file, a subsequent truncate system call enters the do_truncate() routine, which eventually calls ntfs_set_size(). This function attempts to acquire the run_lock via down_write(), but the lock was never initialized for the $Extend inode. The issue was introduced after commit 4e8011ffec79, which changed the inode mode handling; previously, the mode was not set to a regular file, so do_truncate() was not reached [1][2][3].

Exploitation

An attacker with local access to a system using the ntfs3 filesystem can trigger the bug by mounting an NTFS volume and executing a truncate operation on the $Extend inode. No special privileges beyond normal user access are required. The attack surface is limited to systems that mount NTFS volumes with the ntfs3 driver.

Impact

The uninitialized run_lock causes a kernel lockdep warning and potential system instability. The syzbot report shows a stack trace leading to ntfs_set_size and ntfs_extend, indicating that the kernel use of an uninitialized lock can lead to undefined behavior, including crashes [1]. While the immediate impact is a warning, in some configurations it could lead to a denial-of-service condition.

Mitigation

The fix adds run_lock initialization of the run_lock when loading the $Extend inode. The patch has been applied to the stable kernel trees [1][2][3]. Users should update their kernel to a version containing the commit be99c62ac7e7af514e4b13f83c891a3cccefaa48 or later. No workaround is available; the only mitigation is to apply the kernel patch.