CVE-2025-68369 in Linux
Summary
by MITRE • 12/24/2025
In the Linux kernel, the following vulnerability has been resolved:
ntfs3: init run lock for extend inode
After setting the inode mode of $Extend to a regular file, executing the truncate system call will enter the do_truncate() routine, causing the run_lock uninitialized error reported by syzbot.
Prior to patch 4e8011ffec79, if the inode mode of $Extend was not set to a regular file, the do_truncate() routine would not be entered.
Add the run_lock initialization when loading $Extend.
syzbot reported: INFO: trying to register non-static key. Call Trace: dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120 assign_lock_key+0x133/0x150 kernel/locking/lockdep.c:984 register_lock_class+0x105/0x320 kernel/locking/lockdep.c:1299 __lock_acquire+0x99/0xd20 kernel/locking/lockdep.c:5112 lock_acquire+0x120/0x360 kernel/locking/lockdep.c:5868 down_write+0x96/0x1f0 kernel/locking/rwsem.c:1590 ntfs_set_size+0x140/0x200 fs/ntfs3/inode.c:860 ntfs_extend+0x1d9/0x970 fs/ntfs3/file.c:387 ntfs_setattr+0x2e8/0xbe0 fs/ntfs3/file.c:808
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 01/12/2026
The vulnerability CVE-2025-68369 affects the Linux kernel's ntfs3 file system driver and represents a critical initialization flaw that can lead to system instability and potential security implications. This issue specifically targets the handling of the $Extend system file within NTFS3 file systems, where improper locking mechanism initialization causes a kernel lockdep subsystem error. The vulnerability manifests when the system attempts to truncate the $Extend file, which triggers an uninitialized run_lock error during the do_truncate() execution path. The root cause lies in the improper initialization of the run_lock structure when loading the $Extend file, which is essential for maintaining proper synchronization during file operations.
The technical flaw stems from the ntfs3 driver's failure to properly initialize the run_lock structure during the loading process of the $Extend file, which is a special system file used by NTFS for storing various file system metadata. When the inode mode of $Extend is set to a regular file and a truncate operation is performed, the system enters the do_truncate() routine where it attempts to access the uninitialized run_lock, resulting in a lockdep subsystem error. This error is particularly concerning as it indicates a potential for kernel memory corruption or system crashes, since lockdep is designed to detect and prevent lock-related issues that could lead to deadlocks or data corruption. The vulnerability specifically affects the kernel's locking subsystem and demonstrates a clear violation of proper initialization protocols that are fundamental to kernel security.
The operational impact of this vulnerability extends beyond simple system instability to potentially enable privilege escalation or denial of service conditions. When the system encounters this uninitialized lock scenario, it can trigger kernel oops or system crashes that may be exploitable by malicious actors. The vulnerability is particularly dangerous in environments where NTFS3 file systems are actively used, such as in mixed operating system environments or when Linux systems need to mount Windows NTFS volumes. The syzbot automated testing system reported this issue through lockdep subsystem warnings, indicating that this is a well-defined kernel subsystem issue that could be triggered through normal file system operations. According to CWE-665, this represents an improper initialization of a resource, specifically a lock structure, which is a well-known weakness in kernel programming that can lead to undefined behavior.
The mitigation strategy for this vulnerability requires immediate patch application that ensures proper initialization of the run_lock structure during $Extend file loading operations. This fix addresses the core issue by adding the necessary initialization code before the file system operations that might trigger the problematic code path. The patch implementation follows established kernel development practices and aligns with the ATT&CK framework's defense evasion techniques by ensuring proper resource initialization. System administrators should prioritize applying this patch across all systems that utilize NTFS3 file systems, particularly in enterprise environments where mixed operating system compatibility is required. The fix demonstrates proper kernel programming practices that prevent uninitialized memory access patterns and maintain the integrity of the kernel's locking mechanisms. Organizations should also implement monitoring for lockdep warnings and kernel oops messages that might indicate similar uninitialized resource issues in other parts of the kernel codebase.