Linux Kernel CVE-2025-71289

Exploitation requires: (1) local shell access with at minimum low-privilege credentials (CVSS PR:L confirmed); (2) a filesystem mounted using the NTFS3 driver - this is non-default on most Linux distributions and must be explicitly configured by an administrator; (3) the ability to perform file truncation operations on that volume. Exploitation is further limited by the need for an error condition inside attr_set_size() to actually occur (e.g., disk full, storage I/O error), meaning passive use of the vulnerability is not straightforward. There is no network attack vector - AV:L in the CVSS vector explicitly rules out remote exploitation. The absence of user interaction (UI:N) means no social engineering is needed once the above conditions are met.

The CVSS 5.5 score reflects a genuinely constrained threat: AV:L requires physical or shell-level local access, PR:L confirms low-privilege authentication is required, and the sole impact is Availability (C:N/I:N/A:H). EPSS at 0.02% (5th percentile) corroborates that automated or opportunistic exploitation is highly unlikely. The vulnerability is not listed in CISA KEV and no public exploit code has been identified. The 'Information Disclosure' tag applied by the intelligence feed appears inconsistent with the CVSS vector (C:N) and the technical description - the actual impact is filesystem availability and potential integrity corruption of NTFS3 volumes, not confidential data leakage; defenders should treat this tag with skepticism. In practice, exploitation is gated on two conditions: local access to the host and an NTFS3-mounted volume, neither of which is default on most Linux distributions. This is a correctness and stability fix rather than a high-priority security incident, warranting patching within normal maintenance cycles rather than emergency response.

A local user with standard shell access on a Linux host that has an NTFS3 volume mounted deliberately or inadvertently triggers a file truncation that causes attr_set_size() to fail internally (for example, via disk quota exhaustion or I/O error injection). Because the error is silently discarded, the kernel continues with the inode in an inconsistent state, potentially corrupting subsequent file operations on the volume or causing the filesystem to become unmountable, constituting a local denial of service. No public proof-of-concept code has been identified at time of analysis.