Executive brief
A vulnerability in the Linux kernel's NTFS3 file system driver could allow a system crash or memory corruption when processing a specially crafted or corrupted NTFS disk image. This occurs during the 'journal replay' process, which is a standard recovery step when mounting a disk. An attacker could potentially exploit this by tricking a user or system into mounting a malicious drive or partition, leading to a complete system compromise.
Technical details
An out-of-bounds write vulnerability (CWE-787) exists in the fs/ntfs3/fslog.c component of the Linux kernel. The function check_file_record() fails to validate the 'rec->used' field against the record size or attribute offsets. During journal replay, the do_action() handlers use this unvalidated value to calculate lengths for memmove operations (e.g., DeleteAttribute, CreateAttribute). If 'rec->used' is smaller than the attribute offset, an integer underflow occurs, resulting in massive memory copies into a fixed 4KB buffer. This can be triggered by a corrupted or malicious NTFS filesystem. Patches have been released across multiple stable kernel branches to bound 'rec->used' correctly.
Affected products
- Linux Linux Kernel 5.15 to 6.6.136, 6.7 to 6.12.84, 6.13 to 6.18.25, 6.19 to 7.0.2
Timeline
- 2026-05-01: advisory: Initial disclosure and NVD publication
- 2026-04-09: patched: Fix authored by Greg Kroah-Hartman
References
- https://git.kernel.org/stable/c/0112e6279420d4005b3d57af36fb45c01b8d0116
- https://git.kernel.org/stable/c/0ca0485e4b2e837ebb6cbd4f2451aba665a03e4b
- https://git.kernel.org/stable/c/1393a467a9607e62123806de7d4c3a3e54e396a9
- https://git.kernel.org/stable/c/4b1613d7e2deda831a97e427d1ea586e50fe1be5
- https://git.kernel.org/stable/c/8e64d33198b5a0fb14a452708bad844f94f03b2c
- https://git.kernel.org/stable/c/f79d0403ea20a81bc29105bba54fbcab54e8c403
- https://git.kernel.org/stable/c/f90b8a1798b750755a9e9aee66678f0a1820bbaf