Executive brief
A vulnerability in the Linux kernel's NTFS3 file system driver can allow a local user to crash the system or cause it to become unresponsive. By providing a specially crafted, malformed NTFS disk image or partition, an attacker can trigger an infinite loop within the kernel. This results in a denial-of-service condition, potentially halting operations on affected servers or workstations.
Technical details
An infinite loop vulnerability exists in the ntfs3 file system driver within the attr_load_runs_range function. The issue is triggered by inconsistent metadata where an attribute header indicates an empty run list (evcn=-1, svcn=0), but directory entries reference it as containing data. When run_unpack() returns success without initializing the runs_tree, subsequent calls to run_lookup_entry() fail, causing the loop to increment the virtual cluster number (vcn) by zero. This results in an unreachable exit condition (CWE-835). The fix introduces a retry counter to detect consecutive lookup failures and returns -EINVAL to break the loop.
Affected products
- Linux Linux Kernel 5.15 to 5.15.202, 5.16 to 6.1.165, 6.2 to 6.6.128, 6.7 to 6.12.75, 6.13 to 6.18.16, 6.19 to 6.19.6
Timeline
- 2025-12-02: other: Patch authored
- 2026-03-18: advisory: CVE published
- 2026-05-20: other: NVD analysis completed
References
- https://git.kernel.org/stable/c/3c3a6e951b9b53dab2ac460a655313cf04c4a10a
- https://git.kernel.org/stable/c/4b90f16e4bb5607fb35e7802eb67874038da4640
- https://git.kernel.org/stable/c/6f07a590616ff5f57f7c041d98e463fad9e9f763
- https://git.kernel.org/stable/c/78b61f7eac37a63284774b147f38dd0be6cad43c
- https://git.kernel.org/stable/c/a89bc96d5abd8a4a8d5d911884ea347efcdf460b
- https://git.kernel.org/stable/c/af839013c70a24779f9d1afb1575952009312d38
- https://git.kernel.org/stable/c/c0b43c45d45f59e7faad48675a50231a210c379b