In the Linux kernel, the following vulnerability has been resolved:
fs/ntfs3: don't hold ni_lock when calling truncate_setsize()
syzbot is reporting hung task at do_user_addr_fault() [1], for there is a silent deadlock between PG_locked bit and ni_lock lock.
Since filemap_update_page() calls filemap_read_folio() after calling folio_trylock() which will set PG_locked bit, ntfs_truncate() must not call truncate_setsize() which will wait for PG_locked bit to be cleared when holding ni_lock lock.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade bpftool-debuginfoUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-tools-debuginfoUpgrade bpftoolUpgrade kernelUpgrade kernel-headersUpgrade perf-debuginfoUpgrade python-perfUpgrade kernel-develUpgrade kernel-livepatch-5.15.90-54.138Upgrade perfUpgrade kernel-toolsUpgrade python-perf-debuginfoUpgrade kernel-debuginfo-common-aarch64Upgrade kernel-debuginfoUpgrade kernel-tools-devel | May 20, 2026 | May 20, 2026 |
| Debian | — | Upgrade linux | Sep 17, 2025 | Sep 17, 2025 |
| Ubuntu | — | Upgrade linuxUpgrade linux-gcpUpgrade linux-gkeopUpgrade linux-intel-iotgUpgrade linux-gkeUpgrade linux-oracle-5.15Upgrade linux-nvidia-tegra-5.15Upgrade linux-riscv-5.15Upgrade linux-intel-iot-realtimeUpgrade linux-awsUpgrade linux-azureUpgrade linux-ibmUpgrade linux-oracleUpgrade linux-lowlatencyUpgrade linux-raspiUpgrade linux-realtimeUpgrade linux-kvmUpgrade linux-lowlatency-hwe-5.15Upgrade linux-hwe-5.15Upgrade linux-gcp-5.15Upgrade linux-azure-5.15Upgrade linux-intel-iotg-5.15Upgrade linux-bluefieldUpgrade linux-nvidiaUpgrade linux-aws-5.15 | Sep 19, 2025 | Sep 16, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub