In the Linux kernel, the following vulnerability has been resolved:
fs/ntfs3: don't hold ni_lock when calling truncate_setsize()
syzbot is reporting hung task at do_user_addr_fault() [1], for there is a silent deadlock between PG_locked bit and ni_lock lock.
Since filemap_update_page() calls filemap_read_folio() after calling folio_trylock() which will set PG_locked bit, ntfs_truncate() must not call truncate_setsize() which will wait for PG_locked bit to be cleared when holding ni_lock lock.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade bpftool-debuginfoUpgrade kernelUpgrade kernel-tools-debuginfoUpgrade kernel-debuginfo-common-x86_64Upgrade bpftoolUpgrade python-perf-debuginfoUpgrade kernel-headersUpgrade kernel-develUpgrade perf-debuginfoUpgrade perfUpgrade kernel-livepatch-5.15.90-54.138Upgrade kernel-tools-develUpgrade kernel-toolsUpgrade python-perfUpgrade kernel-debuginfo-common-aarch64Upgrade kernel-debuginfo | May 20, 2026 | May 20, 2026 |
| Debian | — | Upgrade linux | Sep 17, 2025 | Sep 17, 2025 |
| Ubuntu | — | Upgrade linux-azureUpgrade linux-azure-5.15Upgrade linux-bluefieldUpgrade linux-aws-5.15Upgrade linux-raspiUpgrade linux-nvidiaUpgrade linux-ibmUpgrade linux-hwe-5.15Upgrade linux-lowlatencyUpgrade linux-gcp-5.15Upgrade linux-intel-iotg-5.15Upgrade linux-oracleUpgrade linux-realtimeUpgrade linux-lowlatency-hwe-5.15Upgrade linux-kvmUpgrade linux-oracle-5.15Upgrade linuxUpgrade linux-intel-iot-realtimeUpgrade linux-riscv-5.15Upgrade linux-gkeopUpgrade linux-awsUpgrade linux-gkeUpgrade linux-gcpUpgrade linux-nvidia-tegra-5.15Upgrade linux-intel-iotg | Sep 19, 2025 | Sep 16, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub