Executive brief
A vulnerability in the Linux kernel's NTFS3 file system driver could allow a system crash or information leakage when a specially crafted storage device or disk image is mounted. The issue occurs because the system does not properly verify the size of data structures while reading NTFS file metadata. This could be exploited by an attacker with physical access to a machine or the ability to trick a user into mounting a malicious disk image.
Technical details
An out-of-bounds (OOB) heap read vulnerability exists in the ntfs3 file system driver within the Linux kernel. The function `run_unpack()` performs a loop check (`run_buf < run_last`) but fails to verify that subsequent reads of `size_size` and `offset_size` via `run_unpack_s64()` stay within the allocated buffer boundaries. A crafted NTFS image containing truncated run data in a Master File Table (MFT) attribute can trigger an OOB read of up to 15 bytes during the mount process. This was discovered via fuzzing with LibAFL and QEMU. Patches have been merged into multiple stable kernel branches to add the necessary boundary checks.
Affected products
- Linux Linux kernel ntfs3 driver
Timeline
- 2026-03-29: other: Vulnerability fixed in source code by Tobias Gaertner
- 2026-05-27: advisory: CVE-2026-46072 published by kernel.org and NVD
References
- https://git.kernel.org/stable/c/41aadf5cb482793a24e05aa136224e179a778586
- https://git.kernel.org/stable/c/b62567bca47408e6739dee75f02a2113548af875
- https://git.kernel.org/stable/c/bf7ac4a1d3bfc6e56e54635c3d331a68170d37c9
- https://git.kernel.org/stable/c/d3012690a7065d9ca86521a525ad11e8af491d45
- https://git.kernel.org/stable/c/e64f7dfcaff79e7dfff9121a382dd77f9b462f62