CVE-2025-71312CWE-401

CVE-2025-71312

Medium · published May 27, 2026

CVSS v3.1
5.5
EPSS
0%
Percentile
2.9
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

fs/ntfs3: fix ntfs_mount_options leak in ntfs_fill_super()

In ntfs_fill_super(), the fc->fs_private pointer is set to NULL without

first freeing the memory it points to. This causes the subsequent call to

ntfs_fs_free() to skip freeing the ntfs_mount_options structure.

This results in a kmemleak report:

unreferenced object 0xff1100015378b800 (size 32):

comm "mount", pid 582, jiffies 4294890685

hex dump (first 32 bytes):

00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................

00 00 00 00 00 00 00 00 ed ff ed ff 00 04 00 00 ................

backtrace (crc ed541d8c):

__kmalloc_cache_noprof+0x424/0x5a0

__ntfs_init_fs_context+0x47/0x590

alloc_fs_context+0x5d8/0x960

__x64_sys_fsopen+0xb1/0x190

do_syscall_64+0x50/0x1f0

entry_SYSCALL_64_after_hwframe+0x76/0x7e

This issue can be reproduced using the following commands:

fallocate -l 100M test.file

mount test.file /tmp/test

Since sbi->options is duplicated from fc->fs_private and does not

directly use the memory allocated for fs_private, it is unnecessary to

set fc->fs_private to NULL.

Additionally, this patch simplifies the code by utilizing the helper

function put_mount_options() instead of open-coding the cleanup logic.

The record
Technical detail
CVSS v3.1
5.5 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00138 · 2.9th percentile
Weakness
CWE-401 · Missing Release of Memory after Effective Lifetime
Published
2026-05-27T18:16Z
Affected products (1)
ProductVersionsFixed in
linux/linux_kernel≥ 6.19, < 6.19.46.19.4
References (2)
EPSS history
Timeline
  • 27 MAY 12:24Z
    fs/ntfs3: fix ntfs_mount_options leak in ntfs_fill_super()
    cvelistv5