CVE-2025-37806

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

fs/ntfs3: Keep write operations atomic

syzbot reported a NULL pointer dereference in __generic_file_write_iter. [1]

Before the write operation is completed, the user executes ioctl[2] to clear

the compress flag of the file, which causes the is_compressed() judgment to

return 0, further causing the program to enter the wrong process and call the

wrong ops ntfs_aops_cmpr, which triggers the null pointer dereference of

write_begin.

Use inode lock to synchronize ioctl and write to avoid this case.

[1]

Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000

Mem abort info:

ESR = 0x0000000086000006

EC = 0x21: IABT (current EL), IL = 32 bits

SET = 0, FnV = 0

EA = 0, S1PTW = 0

FSC = 0x06: level 2 translation fault

user pgtable: 4k pages, 48-bit VAs, pgdp=000000011896d000

[0000000000000000] pgd=0800000118b44403, p4d=0800000118b44403, pud=0800000117517403, pmd=0000000000000000

Internal

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References