Critical NULL Pointer Dereference in Linux Kernel NTFS3 Package
Summary
CVE-2025-37806: In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Keep write operations atomic syzbot reported a NULL pointer dereference in generic_file_write_iter. Affects linux versions 6.1.106-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of the Linux operating system, responsible for managing system resources and facilitating communication between hardware and software. The NTFS3 module allows Linux systems to read and write to NTFS file systems, commonly used by Windows. This module is essential for users who need to access NTFS-formatted drives. However, a recent vulnerability has been identified that compromises the atomicity of write operations, potentially leading to system crashes and data loss.
Vulnerability Detail
The vulnerability, identified as CVE-2025-37806, arises from a NULL pointer dereference in the NTFS3 module during write operations. When a user executes an ioctl command to clear the compress flag of a file before the write operation is completed, it leads to incorrect processing paths and calls to the wrong operations. This mismanagement can cause the system to dereference a NULL pointer, resulting in a kernel panic and potential data corruption. The issue is exacerbated by the lack of synchronization between the ioctl and write operations, which can be exploited by malicious users.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can avoid executing ioctl commands to change file flags during ongoing write operations. This practice can help prevent the occurrence of the NULL pointer dereference until a patch is applied.
Conclusion
CVE-2025-37806 represents a significant vulnerability in the Linux kernel's NTFS3 module, with the potential to cause severe system instability and data loss. Users are urged to apply the necessary updates to mitigate the risks associated with this vulnerability. Until a patch is applied, following the recommended workarounds can help maintain system integrity.
See every vulnerability recorded for linux →
FAQ
CVE-2025-37806 is a vulnerability in the Linux kernel's NTFS3 module that can lead to a NULL pointer dereference during write operations.
Exploitation of this vulnerability can cause kernel panics, leading to system crashes and potential data loss.
Yes, users should update their Linux kernel to a patched version that resolves this issue.
As a temporary measure, avoid changing file flags during write operations to prevent triggering the vulnerability.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Check your application against CVE-2025-37806 using the Vulert playground at Vulert Scanner.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
