Executive brief
A memory leak was identified in the Linux kernel's NTFS3 file system driver. When mounting an NTFS drive, the system fails to properly release certain internal memory structures. Over time, repeated mount operations could consume system memory, potentially leading to performance degradation or system instability.
Technical details
A memory leak exists in fs/ntfs3/super.c within the ntfs_fill_super() function. The root cause is that the fc->fs_private pointer is set to NULL without first freeing the ntfs_mount_options structure it references. This prevents the subsequent ntfs_fs_free() call from performing the necessary cleanup, as detected by kmemleak. An attacker with the ability to perform mount operations could trigger this leak repeatedly to exhaust kernel memory. The issue has been resolved by removing the unnecessary NULL assignment and utilizing the put_mount_options() helper for consistent cleanup.
Affected products
- Linux Linux Kernel ntfs3 driver
Timeline
- 2025-12-09: patched: Initial patch authored
- 2026-05-27: advisory: CVE published