Executive brief
The Linux kernel's NTFS3 filesystem driver contains a buffer overflow vulnerability in its attribute size validation logic. When mounting a specially crafted NTFS filesystem, an attacker can trigger an out-of-bounds read that crashes the system or potentially executes code with kernel privileges. This affects any system that mounts NTFS volumes, including servers and workstations.
Technical details
The vulnerability is a slab-out-of-bounds read in the fs/ntfs3 module's attribute enumeration code, specifically in the run_unpack() function. The root cause is insufficient overflow and boundary checking when examining attribute sizes during filesystem parsing. An attacker can supply a malformed NTFS image with oversized attribute descriptors that bypass validation checks, leading to an out-of-bounds memory access. The vulnerability is triggered during filesystem mount (unprivileged user can mount via user namespaces on some systems), and requires a malicious NTFS image as the attack vector. The Linux kernel developers resolved this by combining overflow and boundary checks to properly validate all attribute sizes before processing.
Affected products
- Linux Linux Kernel 6.0.0-rc7 and prior versions with NTFS3 support
Timeline
- 2025-10-01: disclosed