CVE-2025-68369

HighCVSS 7.5/10Last modified Oct 13, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

ntfs3: init run lock for extend inode

After setting the inode mode of $Extend to a regular file, executing the truncate system call will enter the do_truncate() routine, causing the run_lock uninitialized error reported by syzbot.

Prior to patch 4e8011ffec79, if the inode mode of $Extend was not set to a regular file, the do_truncate() routine would not be entered.

Add the run_lock initialization when loading $Extend.

syzbot reported: INFO: trying to register non-static key. Call Trace: dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120 assign_lock_key+0x133/0x150 kernel/locking/lockdep.c:984 register_lock_class+0x105/0x320 kernel/locking/lockdep.c:1299 __lock_acquire+0x99/0xd20 kernel/locking/lockdep.c:5112 lock_acquire+0x120/0x360 kernel/locking/lockdep.c:5868 down_write+0x96/0x1f0 kernel/locking/rwsem.c:1590 ntfs_set_size+0x140/0x200 fs/ntfs3/inode.c:860 ntfs_extend+0x1d9/0x970 fs/ntfs3/file.c:387 ntfs_setattr+0x2e8/0xbe0 fs/ntfs3/file.c:808

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected software

VendorProductVersions
LinuxLinux>= 63eb6730ce0604d3eacf036c2f68ea70b068317c, < 79c8a77b1782e2ace96d063be3c41ba540d1e20a; >= 78d46f5276ed3589aaaa435580068c5b62efc921, < 433d1f7c628c3cbdd7efce064d6c7acd072cf6c4; >= 17249b2a65274f73ed68bcd1604e08a60fd8a278, < 907bf69c6b6ce5d038eec7a599d67b45b62624bc; >= 37f65e68ba9852dc51c78dbb54a9881c3f0fe4f7, < 6e17555728bc469d484c59db4a0abc65c19bc315; >= 57534db1bbc4ca772393bb7d92e69d5e7b9051cf, < 19164d8228317f3f1fe2662a9ba587cfe3b2d29e; >= 4e8011ffec79717e5fdac43a7e79faf811a384b7, < ab5e8ebeee1caa4fcf8be7d8d62c0a7165469076; >= 4e8011ffec79717e5fdac43a7e79faf811a384b7, < be99c62ac7e7af514e4b13f83c891a3cccefaa48; >= 5.15.197, < 5.15.198; >= 6.1.159, < 6.1.160; >= 6.6.117, < 6.6.120; >= 6.12.58, < 6.12.63; >= 6.17.8, < 6.17.13
LinuxLinux6.18

References

Timeline

Published
Dec 24, 2025
Last modified
Oct 13, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-68379.8A vulnerability classified as critical was found in code-projects Library System 1.0. Affected by this vulnerability is an unknown functionaCVE-2025-683707.8In the Linux kernel, the following vulnerability has been resolved: coresight: tmc: add the handle of the event to the path The handle is CVE-2025-68371In the Linux kernel, the following vulnerability has been resolved: scsi: smartpqi: Fix device resources accessed after device removal CorCVE-2025-68372In the Linux kernel, the following vulnerability has been resolved: nbd: defer config put in recv_work There is one uaf issue in recv_workCVE-2025-68373In the Linux kernel, the following vulnerability has been resolved: md: avoid repeated calls to del_gendisk There is a uaf problem which iCVE-2025-68374In the Linux kernel, the following vulnerability has been resolved: md: fix rcu protection in md_wakeup_thread We attempted to use RCU to CVE-2025-68375In the Linux kernel, the following vulnerability has been resolved: perf/x86: Fix NULL event access and potential PEBS record loss When inCVE-2025-68376In the Linux kernel, the following vulnerability has been resolved: coresight: ETR: Fix ETR buffer use-after-free issue When ETR is enableCVE-2025-68377In the Linux kernel, the following vulnerability has been resolved: ns: initialize ns_list_node for initial namespaces Make sure that the CVE-2025-68378In the Linux kernel, the following vulnerability has been resolved: bpf: Fix stackmap overflow check in __bpf_get_stackid() Syzkaller repoCVE-2025-683797.8In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix null deref on srq->rq.queue after resize failure A NULL CVE-2025-68384.1The Broken Link Notifier plugin for WordPress is vulnerable to CSV Injection in all versions up to, and including, 1.3.0 via broken links th
CVE-2025-68369: High severity, CVSS 7.5 | Vulnix