CVE-2025-71067

Vulnerability

Overview

CVE-2025-71067 is a bug in the Linux kernel's NTFS3 file system driver. During mount, the kernel's block device layer may set the superblock's s_blocksize to zero if the device's physical block size is larger than the system's page size (PAGE_SIZE). This occurs because sb_set_blocksize() does not override a value exceeding PAGE_SIZE, leaving the superblock with an undefined block size[1].

Exploitation

Scenario

An attacker with the ability to mount a crafted NTFS3 image can trigger the vulnerability. The exploit path involves setting the block device size to a value > PAGE_SIZE (e.g., 16384 on a 4096-byte page system) before mounting the NTFS3 volume. This can be achieved using the ioctl$FS_IOC_SETFLAGS call. When ntfs_init_from_boot() subsequently attempts to read the boot block using the zero s_blocksize, it causes a kernel crash[1].

Impact

Successful exploitation leads to a denial of service (system crash) due to an incorrect memory access. The prerequisite is the ability to mount a malicious NTFS3 volume, but no special privileges beyond the global mount capability are required on a default Linux system. The bug was reproduced via a syzkaller-generated test case[1].

Mitigation

The fix, applied in the Linux kernel stable git commits (references [1], [2], [3]), sets a temporary dummy blocksize in the mounting code before reading the boot block. This ensures the read operation uses a valid block size even if the later sb_set_blocksize() fails. Users should update their kernels to include one of the cherry-picked commits.