CVE-2025-68369 Details
Description
In the Linux kernel, the following vulnerability has been resolved: ntfs3: init run lock for extend inode After setting the inode mode of $Extend to a regular file, executing the truncate system call will enter the do_truncate() routine, causing the run_lock uninitialized error reported by syzbot. Prior to patch 4e8011ffec79, if the inode mode of $Extend was not set to a regular file, the do_truncate() routine would not be entered. Add the run_lock initialization when loading $Extend. syzbot reported: INFO: trying to register non-static key. Call Trace: dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120 assign_lock_key+0x133/0x150 kernel/locking/lockdep.c:984 register_lock_class+0x105/0x320 kernel/locking/lockdep.c:1299 __lock_acquire+0x99/0xd20 kernel/locking/lockdep.c:5112 lock_acquire+0x120/0x360 kernel/locking/lockdep.c:5868 down_write+0x96/0x1f0 kernel/locking/rwsem.c:1590 ntfs_set_size+0x140/0x200 fs/ntfs3/inode.c:860 ntfs_extend+0x1d9/0x970 fs/ntfs3/file.c:387 ntfs_setattr+0x2e8/0xbe0 fs/ntfs3/file.c:808
A vulnerability exists in the Linux kernel's NTFS3 file system handling, specifically related to the initialization of a run lock for extend inodes. When the inode mode of the $Extend attribute is set to a regular file, the truncate system call triggers the do_truncate() routine. This process exposes an uninitialized run_lock error, as reported by syzbot. The issue arises because, prior to a certain patch, the do_truncate() routine was not activated unless the $Extend inode mode was already set to a regular file. The vulnerability has been addressed by adding the necessary run_lock initialization when loading the $Extend inode.
Users can apply the latest patches available in the Linux kernel stable tree to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Dec 24, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://git.kernel.org/stable/c/19164d8228317f3f1fe2662a9ba587cfe3b2d29e | kernel.org | Source CodeVendor |
| https://git.kernel.org/stable/c/433d1f7c628c3cbdd7efce064d6c7acd072cf6c4 | kernel.org | |
| https://git.kernel.org/stable/c/6e17555728bc469d484c59db4a0abc65c19bc315 | kernel.org | Source CodeVendor |
| https://git.kernel.org/stable/c/79c8a77b1782e2ace96d063be3c41ba540d1e20a | kernel.org | |
| https://git.kernel.org/stable/c/907bf69c6b6ce5d038eec7a599d67b45b62624bc | kernel.org | |
| https://git.kernel.org/stable/c/ab5e8ebeee1caa4fcf8be7d8d62c0a7165469076 | kernel.org | Source CodeVendor |
| https://git.kernel.org/stable/c/be99c62ac7e7af514e4b13f83c891a3cccefaa48 | kernel.org | Source CodeVendor |
Weakness Enumeration
No weakness enumeration is available for this CVE.
Affected Products
| Product | Versions |
|---|---|
| Linux kernel | < 4e8011ffec79 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 30, 2026 | CVE Modified | kernel.org |
| Jun 17, 2026 | CVE Modified | kernel.org |
| Jan 19, 2026 | CVE Modified | kernel.org |
| Jan 11, 2026 | CVE Modified | kernel.org |
| Dec 24, 2025 | New CVE Received | kernel.org |