Executive brief
A vulnerability was identified in the Linux kernel's NTFS3 file system driver, which handles how the operating system interacts with Windows-formatted drives. Due to a flaw in how the system reads certain file attributes, a local user could potentially cause a system crash or unpredictable memory behavior. This could lead to service disruptions or system instability on affected Linux machines.
Technical details
A use-after-free vulnerability exists in the fs/ntfs3 component of the Linux kernel. The function 'ntfs_read_ea' performs sanity checks on extended attributes (EAs) but fails to return an appropriate error code (e.g., -EINVAL) when inconsistencies are detected. This failure allows subsequent operations, such as 'ntfs_set_ea', to proceed with invalid state information, resulting in out-of-bounds or use-after-free memory accesses. An attacker with local access could exploit this by providing a specially crafted NTFS volume or attribute set to trigger a kernel panic (DoS). Patches have been released for various stable branches including 5.15.y, 6.1.y, and 6.4.y.
Affected products
- Linux Linux Kernel 5.15.121, 6.1.40, 6.2.0-rc1+
Timeline
- 2023-03-17: other: Patch authored
- 2023-08-23: patched: Patch committed to stable tree
- 2025-12-24: advisory: CVE published