CVE-2025-71312
Full vulnerability record from the local CVENow database.
Description
In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: fix ntfs_mount_options leak in ntfs_fill_super() In ntfs_fill_super(), the fc->fs_private pointer is set to NULL without first freeing the memory it points to. This causes the subsequent call to ntfs_fs_free() to skip freeing the ntfs_mount_options structure. This results in a kmemleak report: unreferenced object 0xff1100015378b800 (size 32): comm "mount", pid 582, jiffies 4294890685 hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 ed ff ed ff 00 04 00 00 ................ backtrace (crc ed541d8c): __kmalloc_cache_noprof+0x424/0x5a0 __ntfs_init_fs_context+0x47/0x590 alloc_fs_context+0x5d8/0x960 __x64_sys_fsopen+0xb1/0x190 do_syscall_64+0x50/0x1f0 entry_SYSCALL_64_after_hwframe+0x76/0x7e This issue can be reproduced using the following commands: fallocate -l 100M test.file mount test.file /tmp/test Since sbi->options is duplicated from fc->fs_private and does not directly use the memory allocated for fs_private, it is unnecessary to set fc->fs_private to NULL. Additionally, this patch simplifies the code by utilizing the helper function put_mount_options() instead of open-coding the cleanup logic.
Severity
MEDIUM
CVSS score
5.5
(v3.1)
Vulnerability status
Modified
Source identifier
416baaa9-dc9f-4396-8d5f-8c081fb06d67
Published
2026-05-27 14:16:43.763000
Last modified
2026-10-26 16:17:09.720000
View original CVE JSON
{
"id": "CVE-2025-71312",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2026-05-27T14:16:43.763",
"lastModified": "2026-10-26T16:17:09.720",
"vulnStatus": "Modified",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs/ntfs3: fix ntfs_mount_options leak in ntfs_fill_super()\n\nIn ntfs_fill_super(), the fc->fs_private pointer is set to NULL without\nfirst freeing the memory it points to. This causes the subsequent call to\nntfs_fs_free() to skip freeing the ntfs_mount_options structure.\n\nThis results in a kmemleak report:\n\n unreferenced object 0xff1100015378b800 (size 32):\n comm \"mount\", pid 582, jiffies 4294890685\n hex dump (first 32 bytes):\n 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................\n 00 00 00 00 00 00 00 00 ed ff ed ff 00 04 00 00 ................\n backtrace (crc ed541d8c):\n __kmalloc_cache_noprof+0x424/0x5a0\n __ntfs_init_fs_context+0x47/0x590\n alloc_fs_context+0x5d8/0x960\n __x64_sys_fsopen+0xb1/0x190\n do_syscall_64+0x50/0x1f0\n entry_SYSCALL_64_after_hwframe+0x76/0x7e\n\nThis issue can be reproduced using the following commands:\n fallocate -l 100M test.file\n mount test.file /tmp/test\n\nSince sbi->options is duplicated from fc->fs_private and does not\ndirectly use the memory allocated for fs_private, it is unnecessary to\nset fc->fs_private to NULL.\n\nAdditionally, this patch simplifies the code by utilizing the helper\nfunction put_mount_options() instead of open-coding the cleanup logic."
},
{
"lang": "es",
"value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nfs/ntfs3: corrección de fuga de ntfs_mount_options en ntfs_fill_super()\n\nEn ntfs_fill_super(), el puntero fc -> fs_private se establece en NULL sin liberar primero la memoria a la que apunta. Esto provoca que la llamada subsiguiente a ntfs_fs_free() omita liberar la estructura ntfs_mount_options.\n\nEsto resulta en un informe de kmemleak:\n\n objeto sin referencia 0xff1100015378b800 (tamaño 32):\n comm 'mount', pid 582, jiffies 4294890685\n volcado hexadecimal (primeros 32 bytes):\n 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................\n 00 00 00 00 00 00 00 00 ed ff ed ff 00 04 00 00 ................\n rastreo de pila (crc ed541d8c):\n __kmalloc_cache_noprof+0x424/0x5a0\n __ntfs_init_fs_context+0x47/0x590\n alloc_fs_context+0x5d8/0x960\n __x64_sys_fsopen+0xb1/0x190\n do_syscall_64+0x50/0x1f0\n entry_SYSCALL_64_after_hwframe+0x76/0x7e\n\nEste problema puede reproducirse usando los siguientes comandos:\n fallocate -l 100M test.file\n mount test.file /tmp/test\n\nDado que sbi -> options se duplica de fc -> fs_private y no utiliza directamente la memoria asignada para fs_private, es innecesario establecer fc -> fs_private en NULL.\n\nAdemás, este parche simplifica el código al utilizar la función auxiliar put_mount_options() en lugar de codificar directamente la lógica de limpieza."
}
],
"affected": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"affectedData": [
{
"vendor": "Linux",
"product": "Linux",
"defaultStatus": "unaffected",
"programFiles": [
"fs/ntfs3/super.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"versions": [
{
"version": "129b0a64fe9ac5b4138cc123cccbcce7c65afdf4",
"lessThan": "d977b979081ef2585a15453f309a6311c95ede02",
"versionType": "git",
"status": "affected"
},
{
"version": "aee4d5a521e94f658e46c904e08a473daa9c8fc0",
"lessThan": "dac871d833b09495198dcac81d2ebaa8db11acbc",
"versionType": "git",
"status": "affected"
},
{
"version": "aee4d5a521e94f658e46c904e08a473daa9c8fc0",
"lessThan": "f7edab0cee03a1cbe0e55a7bcab8d2d8b6b74278",
"versionType": "git",
"status": "affected"
}
]
},
{
"vendor": "Linux",
"product": "Linux",
"defaultStatus": "affected",
"programFiles": [
"fs/ntfs3/super.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"versions": [
{
"version": "6.19",
"status": "affected"
},
{
"version": "0",
"lessThan": "6.19",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.19.4",
"lessThanOrEqual": "6.19.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "7.0",
"lessThanOrEqual": "*",
"versionType": "original_commit_for_fix",
"status": "unaffected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 1.8,
"impactScore": 3.6
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-401"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.19",
"versionEndExcluding": "6.19.4",
"matchCriteriaId": "672A3E79-EC03-479D-8503-361DFBDC8092"
}
]
}
]
}
],
"references": [
{
"url": "https://git.kernel.org/stable/c/d977b979081ef2585a15453f309a6311c95ede02",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/dac871d833b09495198dcac81d2ebaa8db11acbc",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/f7edab0cee03a1cbe0e55a7bcab8d2d8b6b74278",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
}
]
}