Executive brief
The Linux kernel's NTFS3 file system driver contains a memory safety flaw that can be triggered when mounting a maliciously crafted NTFS volume. An attacker can craft a malicious NTFS disk image to cause a use-after-free condition, potentially leading to data corruption, kernel crash, or privilege escalation when an administrator or user mounts the volume.
Technical details
The NTFS3 file system driver in the Linux kernel fails to validate the data run offset before unpacking data runs, leading to a use-after-free vulnerability. The root cause is insufficient sanity checking in the run_unpack() function when processing NTFS data runs from a crafted file system. An attacker can supply a malicious NTFS volume with invalid data run offsets that cause the kernel to read from freed memory. The vulnerability is triggered during file system mount operations, requiring local access to mount a device or image. The flaw permits arbitrary memory read/write or denial of service via kernel crash. A fix has been implemented by adding proper validation of data run offsets before unpacking.
Affected products
- Linux Linux kernel 5.19.0 and likely earlier
Timeline
- 2025-10-04: disclosed