CVE-2025-71311CWE-908

CVE-2025-71311

High · published May 27, 2026

CVSS v3.1
8.2
EPSS
0%
Percentile
24.1
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

fs/ntfs3: Initialize new folios before use

KMSAN reports an uninitialized value in longest_match_std(), invoked

from ntfs_compress_write(). When new folios are allocated without being

marked uptodate and ni_read_frame() is skipped because the caller expects

the frame to be completely overwritten, some reserved folios may remain

only partially filled, leaving the rest memory uninitialized.

The record
Technical detail
CVSS v3.1
8.2 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00323 · 24.1th percentile
Weakness
CWE-908 · Use of Uninitialized Resource
Published
2026-05-27T18:16Z
Affected products (3)
ProductVersionsFixed in
linux/linux_kernel≥ 6.11, < 6.12.756.12.75
linux/linux_kernel≥ 6.13, < 6.18.146.18.14
linux/linux_kernel≥ 6.19, < 6.19.46.19.4
References (4)
https://git.kernel.org/stable/c/41d79f8e2a36622d148719bf7c18b46ac1264284 · 416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/5a30cc03bde169ad558695b26da6ea7e55f6194a · 416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/dd6c81527d097b3b0bf5a15c2fdc9657d045144c · 416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/f223ebffa185cc8da934333c5a31ff2d4f992dc9 · 416baaa9-dc9f-4396-8d5f-8c081fb06d67
EPSS history
Timeline
  • 27 MAY 12:24Z
    fs/ntfs3: Initialize new folios before use
    cvelistv5