Executive brief
A vulnerability was identified in the Linux kernel's NTFS3 file system driver, which is used to read and write Windows-formatted drives. An error in how the system calculates disk boundaries could allow specially crafted file data to bypass safety checks. This could potentially lead to system instability or unauthorized memory access when processing malicious NTFS volumes.
Technical details
An integer overflow exists in the `run_unpack()` function within `fs/ntfs3/run.c` of the Linux kernel. The vulnerability is rooted in a volume boundary check (`lcn + len > sbi->used.bitmap.nbits`) that uses raw addition. For sufficiently large values of Logical Cluster Number (LCN) and length (len), the addition can wrap around, bypassing the validation intended to ensure the LCN range remains within the volume's bitmap boundaries. An attacker could exploit this by providing a specially crafted NTFS volume or image. The fix replaces the raw addition with the `check_add_overflow()` macro to safely validate the range. Patches have been merged into multiple stable kernel branches.
Affected products
- Linux Linux Kernel ntfs3 driver
Timeline
- 2026-03-29: other: Vulnerability fixed in source code by Tobias Gaertner
- 2026-05-27: disclosed: CVE-2026-46062 published
References
- https://git.kernel.org/stable/c/60dab3e2931f3d792438a77a6cb0cb731c43300b
- https://git.kernel.org/stable/c/6175d09c23bec4b60860ee9a0170308ff4b56e10
- https://git.kernel.org/stable/c/984a415f019536ea2d24de9010744e5302a9a948
- https://git.kernel.org/stable/c/a954061b334ec67c79ae9d0cadd83fa521396487
- https://git.kernel.org/stable/c/f1af27cec07a9fd0847166bdb23c99e86b05bfdc