# CVE-2025-71267

## Summary

- **CVE ID:** CVE-2025-71267
- **Severity:** MEDIUM
- **CVSS Score:** 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
- **CWE:** N/A
- **Published:** Mar 18, 2026
- **Last Modified:** Sep 8, 2026

## Description

In the Linux kernel, the following vulnerability has been resolved:

fs: ntfs3: fix infinite loop triggered by zero-sized ATTR_LIST

We found an infinite loop bug in the ntfs3 file system that can lead to a
Denial-of-Service (DoS) condition.

A malformed NTFS image can cause an infinite loop when an ATTR_LIST attribute
indicates a zero data size while the driver allocates memory for it.

When ntfs_load_attr_list() processes a resident ATTR_LIST with data_size set
to zero, it still allocates memory because of al_aligned(0). This creates an
inconsistent state where ni->attr_list.size is zero, but ni->attr_list.le is
non-null. This causes ni_enum_attr_ex to incorrectly assume that no attribute
list exists and enumerates only the primary MFT record. When it finds
ATTR_LIST, the code reloads it and restarts the enumeration, repeating
indefinitely. The mount operation never completes, hanging the kernel thread.

This patch adds validation to ensure that data_size is non-zero before memory
allocation. When a zero-sized ATTR_LIST is detected, the function returns
-EINVAL, preventing a DoS vulnerability.

## Affected Products

- Linux — Linux (be71b5cba2e6485e8959da7a9f9a44461a1bb074)
- Linux — Linux (5.15)
- Linux — Linux (0)
- Linux — Linux (5.15.202)
- Linux — Linux (6.1.165)
- Linux — Linux (6.6.128)
- Linux — Linux (6.12.75)
- Linux — Linux (6.18.16)
- Linux — Linux (6.19.6)
- Linux — Linux (7.0-rc1)
- Linux — Linux (7.0)

## References

- [CNA](https://git.kernel.org/stable/c/9267d99fade76d44d4a133599524031fe684156e)
- [CNA](https://git.kernel.org/stable/c/976e6a7c51fabf150478decbe8ef5d9a26039b7c)
- [CNA](https://git.kernel.org/stable/c/8d8c70b57dbeda3eb165c0940b97e85373ca9354)
- [CNA](https://git.kernel.org/stable/c/7ef219656febf5ae06ae56b1fce47ebd05f92b68)
- [CNA](https://git.kernel.org/stable/c/9779a6eaaabdf47aa57910d352b398ad742e6a5f)
- [CNA](https://git.kernel.org/stable/c/fd508939dbca5eceefb2d0c2564beb15469572f2)
- [CNA](https://git.kernel.org/stable/c/06909b2549d631a47fcda249d34be26f7ca1711d)
- [siemens-SADP](https://cert-portal.siemens.com/productcert/html/ssa-082556.html)
- [siemens-SADP](https://cert-portal.siemens.com/productcert/html/ssa-019113.html)

## Exploitation Prediction (EPSS)

- **EPSS Score:** 0.12%
- **EPSS Percentile:** 2.2

---
_Exported from OnDuty AI Vulnerability Intelligence on 2026-09-18._