CVE-2025-71312

fs/ntfs3: fix ntfs_mount_options leak in ntfs_fill_super()

State
Published
Severity
Not scored
Published
May 27, 2026
Updated
Oct 26, 2026
Reserved
May 27, 2026

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

fs/ntfs3: fix ntfs_mount_options leak in ntfs_fill_super()

In ntfs_fill_super(), the fc->fs_private pointer is set to NULL without first freeing the memory it points to. This causes the subsequent call to ntfs_fs_free() to skip freeing the ntfs_mount_options structure.

This results in a kmemleak report:

unreferenced object 0xff1100015378b800 (size 32): comm "mount", pid 582, jiffies 4294890685 hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 ed ff ed ff 00 04 00 00 ................ backtrace (crc ed541d8c): __kmalloc_cache_noprof+0x424/0x5a0 __ntfs_init_fs_context+0x47/0x590 alloc_fs_context+0x5d8/0x960 __x64_sys_fsopen+0xb1/0x190 do_syscall_64+0x50/0x1f0 entry_SYSCALL_64_after_hwframe+0x76/0x7e

This issue can be reproduced using the following commands: fallocate -l 100M test.file mount test.file /tmp/test

Since sbi->options is duplicated from fc->fs_private and does not directly use the memory allocated for fs_private, it is unnecessary to set fc->fs_private to NULL.

Additionally, this patch simplifies the code by utilizing the helper function put_mount_options() instead of open-coding the cleanup logic.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • 129b0a64fe9ac5b4138cc123cccbcce7c65afdf4 to before d977b979081ef2585a15453f309a6311c95ede02Affected
  • aee4d5a521e94f658e46c904e08a473daa9c8fc0 to before dac871d833b09495198dcac81d2ebaa8db11acbcAffected
  • aee4d5a521e94f658e46c904e08a473daa9c8fc0 to before f7edab0cee03a1cbe0e55a7bcab8d2d8b6b74278Affected
LinuxLinux
  • 6.19Affected
  • before 6.19Not affected
  • 6.19.4 through 6.19.*Not affected
  • 7.0 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.