Riskcovery

CVE-2025-71311

fs/ntfs3: Initialize new folios before use

State
Published
Severity
8.2 High
Published
May 27, 2026
Updated
Aug 5, 2026
Reserved
May 27, 2026

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

fs/ntfs3: Initialize new folios before use

KMSAN reports an uninitialized value in longest_match_std(), invoked from ntfs_compress_write(). When new folios are allocated without being marked uptodate and ni_read_frame() is skipped because the caller expects the frame to be completely overwritten, some reserved folios may remain only partially filled, leaving the rest memory uninitialized.

Scores

CVSSScoreVectorSource
3.18.2 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:NLinux

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • 584f60ba22f79c89e6708ab82a5b5d9b8fa21fb2 to before dd6c81527d097b3b0bf5a15c2fdc9657d045144cAffected
  • 584f60ba22f79c89e6708ab82a5b5d9b8fa21fb2 to before 5a30cc03bde169ad558695b26da6ea7e55f6194aAffected
  • 584f60ba22f79c89e6708ab82a5b5d9b8fa21fb2 to before 41d79f8e2a36622d148719bf7c18b46ac1264284Affected
  • 584f60ba22f79c89e6708ab82a5b5d9b8fa21fb2 to before f223ebffa185cc8da934333c5a31ff2d4f992dc9Affected
LinuxLinux
  • 6.11Affected
  • before 6.11Not affected
  • 6.12.75 through 6.12.*Not affected
  • 6.18.14 through 6.18.*Not affected
  • 6.19.4 through 6.19.*Not affected
  • 7.0 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.