Executive brief
The Linux kernel's NTFS3 filesystem implementation contains a vulnerability in how it validates index root structures when initializing NTFS security descriptors. This can allow a malicious NTFS filesystem image to trigger a use-after-free memory error during mount, potentially causing a denial of service or allowing code execution with elevated privileges.
Technical details
The vulnerability is a use-after-free condition in the fs/ntfs3 module, triggered during the initialization of NTFS security ($SDH and $SII index roots). The root cause is insufficient validation of index root structures when processing a malformed NTFS filesystem. An attacker can craft a specially designed NTFS filesystem that, when mounted by a local user, triggers the use-after-free via the hdr_find_e() function during index lookup. The attack requires the ability to provide a malicious filesystem image to be mounted, either locally or via network. The fix involves enhanced sanity checks for the $SDH and $SII index roots to ensure they are legitimate before processing. Patches are available in subsequent kernel versions.
Affected products
- Linux Linux kernel before patched version
Timeline
- 2025-12-24: disclosed