Executive brief
A vulnerability was identified in the Linux kernel's NTFS3 file system driver, which is used to read and write Windows-formatted drives. A flaw in how the system processes file index entries could allow a malicious actor to trigger a memory error. This could potentially lead to a system crash or unauthorized access to sensitive kernel memory, impacting the stability and security of the operating system.
Technical details
A slab-out-of-bounds read and subsequent heap buffer overflow exists in the ntfs3 driver's 'do_action' function within fs/ntfs3/fslog.c. When processing the 'DeleteIndexEntryRoot' case, the 'esize' (entry size) is retrieved from a log record without validation. The code uses this size to calculate a memory offset for a 'memmove' operation; if 'esize' is maliciously large, the pointer arithmetic results in a negative offset. When cast to size_t, this becomes a massive unsigned integer, causing 'memmove' to overwrite heap memory. The fix introduces a check to ensure 'esize' fits within the remaining used space of the index header.
Affected products
- Linux Linux Kernel ntfs3 driver
Timeline
- 2026-01-17: other: Vulnerability fixed in source code by Jiasheng Jiang
- 2026-05-27: disclosed: CVE-2026-45935 published
References
- https://git.kernel.org/stable/c/36c03f7f177b34d51f1cf1d2304b1074607bf4b0
- https://git.kernel.org/stable/c/78942172d5bff4d4afed8674abc09cc560ce44a0
- https://git.kernel.org/stable/c/a584b9d1059b29e97e17c919274e9adfb846f2a0
- https://git.kernel.org/stable/c/b271c9cb85927210b1b799e55ee7f702d12b4336
- https://git.kernel.org/stable/c/b2bc7c44ed1779fc9eaab9a186db0f0d01439622
- https://git.kernel.org/stable/c/c065541b71b79874c83d418a9acd18ad5826339b
- https://git.kernel.org/stable/c/f3b437a4c3e022a1449658ae9f3dd34859894513