CVE-2025-68728 in Linux
Summary
by MITRE • 12/24/2025
In the Linux kernel, the following vulnerability has been resolved:
ntfs3: fix uninit memory after failed mi_read in mi_format_new
Fix a KMSAN un-init bug found by syzkaller.
ntfs_get_bh() expects a buffer from sb_getblk(), that buffer may not be uptodate. We do not bring the buffer uptodate before setting it as uptodate. If the buffer were to not be uptodate, it could mean adding a buffer with un-init data to the mi record. Attempting to load that record will trigger KMSAN.
Avoid this by setting the buffer as uptodate, if it’s not already, by overwriting it.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 01/12/2026
The vulnerability CVE-2025-68728 represents a critical memory initialization flaw within the Linux kernel's ntfs3 filesystem driver that was identified through systematic fuzzing analysis. This issue specifically affects the ntfs3 filesystem implementation and stems from improper handling of buffer states during filesystem operations. The vulnerability was discovered using syzkaller, a sophisticated fuzzer designed to identify kernel-level issues, and manifests as a KMSAN (Kernel Memory Sanitizer) detection indicating uninitialized memory usage. The flaw occurs in the mi_format_new function where memory initialization checks fail to properly validate buffer states before processing.
The technical root cause of this vulnerability lies in the ntfs_get_bh() function's handling of buffer management within the NTFS3 filesystem driver. When the function requests a buffer from sb_getblk(), it assumes the buffer will be in a consistent state, but this assumption fails when the buffer is not already marked as uptodate. The kernel's buffer management system allows for buffers to exist in uninitialized states, and the ntfs3 driver fails to properly initialize these buffers before incorporating them into metadata records. This creates a scenario where uninitialized memory segments are added to the mi (metadata information) record structure, leading to undefined behavior when the system attempts to process these records.
The operational impact of this vulnerability extends beyond simple memory corruption, creating potential security implications through information disclosure and system instability. When the filesystem attempts to load metadata records containing uninitialized memory, the KMSAN detection mechanism triggers, indicating that sensitive kernel memory contents could be inadvertently exposed or that the system may exhibit unpredictable behavior. This vulnerability particularly affects systems running Linux kernels with ntfs3 filesystem support, potentially allowing attackers to exploit the uninitialized memory access patterns to gain insights into kernel memory layout or potentially cause system crashes. The flaw represents a classic case of improper memory initialization that can lead to both confidentiality and availability concerns.
Mitigation strategies for CVE-2025-68728 should focus on ensuring proper buffer state management within the ntfs3 filesystem driver. The fix implemented addresses this by explicitly setting buffers as uptodate before incorporating them into metadata records, effectively overwriting any uninitialized data that might exist in the buffer. This approach aligns with established security practices for kernel memory management and follows the principle of least privilege by ensuring that no uninitialized memory segments are processed as valid data. System administrators should prioritize applying the kernel updates containing this fix, particularly in environments where NTFS3 filesystems are actively used. The vulnerability demonstrates the importance of comprehensive memory initialization checks in kernel subsystems and highlights how seemingly minor buffer management issues can lead to significant security implications. This fix specifically addresses CWE-457: Use of Uninitialized Variable, which is a fundamental security concern in kernel development, and represents a preventive measure against potential exploitation through information leakage or system instability attacks.