CVE-2025-71266fs: ntfs3: check return value of indx_find to avoid infinite loop
Updated under an hour ago ()
Does this affect you?
It affects Linux and 4 other products. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: fs: ntfs3: check return value of indx_find to avoid infinite loop We found an infinite loop bug in the ntfs3 file system that can lead to a Denial-of-Service (DoS) condition. A malformed dentry in the ntfs3 filesystem can cause the kernel to hang during the lookup operations. By setting the HAS_SUB_NODE flag in an INDEX_ENTRY within a directory's INDEX_ALLOCATION block and manipulating the VCN pointer, an attacker can cause the indx_find() function to repeatedly read the same block, allocating 4 KB of memory each time. The kernel lacks VCN loop detection and depth limits, causing memory exhaustion and an OOM crash. This patch adds a return value check for fnd_push() to prevent a memory exhaustion vulnerability caused by infinite loops. When the index exceeds the size of the fnd->nodes array, fnd_push() returns -EINVAL. The indx_find() function checks this return value and stops processing, preventing further memory allocation.
- CVSS
- 5.5 MEDIUM (v3.1, NVD)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Modified
- Record last updated
- Oct 15, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | 82cae269cfa953032fbb8980a7d554d60fb00b17 builds before 14c3188afbedfd5178bbabb8002487ea14b37b56; from 82cae269cfa953032fbb8980a7d554d60fb00b17 before 435d34719db0e130f6f0c621d67ed524cc1a7d10; 82cae269cfa953032fbb8980a7d554d60fb00b17 builds before 68e32694be231c1cdb99b7637a657314e88e1a96; from 82cae269cfa953032fbb8980a7d554d60fb00b17 before 398e768d1accd1f5645492ab996005d7aa84a5b0; from 82cae269cfa953032fbb8980a7d554d60fb00b17 before b0ea441f44ce64fa514a415d4a9e6e2b06e7946c; 82cae269cfa953032fbb8980a7d554d60fb00b17 builds before 0ad7a1be44479503dbe5c699759861ef5b8bd70c; from 82cae269cfa953032fbb8980a7d554d60fb00b17 before 1732053c8a6b360e2d5afb1b34fe9779398b072c | CNA record |
Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP siemens:simatic_s7_1500_cpu_1518_4_pn_dp_mfp (from the name) | from V3.1.6 | CISA ADP |
Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP siemens:simatic_s7_1500_cpu_1518f_4_pn_dp_mfp (from the name) | from V3.1.6 | CISA ADP |
Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP siemens:siplus_s7_1500_cpu_1518_4_pn_dp_mfp (from the name) | from V3.1.6 | CISA ADP |
linux linux_kernel linux:linux_kernel | from 5.15.1 before 5.15.202; from 5.16 before 6.1.165; from 6.2 before 6.6.128; from 6.7 before 6.12.75; from 6.13 before 6.18.16; from 6.19 before 6.19.6; 5.15 | NVD |
References
- https://git.kernel.org/stable/c/14c3188afbedfd5178bbabb8002487ea14b37b56patch
- https://git.kernel.org/stable/c/435d34719db0e130f6f0c621d67ed524cc1a7d10patch
- https://git.kernel.org/stable/c/68e32694be231c1cdb99b7637a657314e88e1a96patch
- https://git.kernel.org/stable/c/398e768d1accd1f5645492ab996005d7aa84a5b0patch
- https://git.kernel.org/stable/c/b0ea441f44ce64fa514a415d4a9e6e2b06e7946cpatch
- https://git.kernel.org/stable/c/0ad7a1be44479503dbe5c699759861ef5b8bd70cpatch
- https://git.kernel.org/stable/c/1732053c8a6b360e2d5afb1b34fe9779398b072cpatch
- https://cert-portal.siemens.com/productcert/html/ssa-019113.html
- https://cert-portal.siemens.com/productcert/html/ssa-082556.html
- https://cert-portal.siemens.com/productcert/html/ssa-457936.html
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.