Executive brief
A vulnerability in the Linux kernel's NTFS3 file system driver could allow a local user to cause system instability. When a file is resized (truncated), the system may fail to properly handle errors, leading to internal data inconsistencies. This could result in a system crash or denial of service, affecting the availability of the machine.
Technical details
A vulnerability exists in the fs/ntfs3/file.c component of the Linux kernel. When performing a truncate operation on a file, the ntfs_truncate function calls attr_set_size() but fails to check its return value if the operation fails while truncating down. This silent failure can leave the inode in an inconsistent state, leading to potential kernel panics or filesystem corruption. An attacker with local access and the ability to modify files on an NTFS3 partition could trigger this condition to cause a denial of service. The issue has been addressed by properly checking the error code and returning it to the caller, and by ensuring inode dirty flags are correctly set.
Affected products
- Linux Linux Kernel 5.15 to 6.19.6
Timeline
- 2025-12-29: patched: Initial patch committed to mainline kernel
- 2026-05-06: disclosed: CVE published by kernel.org
- 2026-05-13: advisory: NVD analysis completed