CVE-2025-68728

CVE-2025-68728

published December 24, 2025

CVSS
—
EPSS
0%
Percentile
8.5
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

ntfs3: fix uninit memory after failed mi_read in mi_format_new

Fix a KMSAN un-init bug found by syzkaller.

ntfs_get_bh() expects a buffer from sb_getblk(), that buffer may not be

uptodate. We do not bring the buffer uptodate before setting it as

uptodate. If the buffer were to not be uptodate, it could mean adding a

buffer with un-init data to the mi record. Attempting to load that record

will trigger KMSAN.

Avoid this by setting the buffer as uptodate, if it’s not already, by

overwriting it.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00193 · 8.5th percentile
Published
2025-12-24T16:16Z
References (7)
EPSS history
Timeline
  • 24 DEC 10:33Z
    ntfs3: fix uninit memory after failed mi_read in mi_format_new
    cvelistv5