Executive brief
A vulnerability was identified in the Linux kernel's NTFS3 file system driver where it failed to properly terminate a volume label string after converting it to UTF-8. This could allow a local attacker with the ability to mount a specially crafted NTFS volume to cause the system to read beyond the intended memory buffer when displaying the volume label. Such an issue typically leads to system instability or the unintended disclosure of small amounts of kernel memory.
Technical details
In the fs/ntfs3 driver, the function ntfs_fill_super() uses utf16s_to_utf8s() to convert the on-disk volume label to UTF-8 and stores it in sbi->volume.label. However, utf16s_to_utf8s() does not append a NUL terminator. When the label is later accessed via ntfs3_label_show() using a %s format string, the kernel may read past the end of the fixed-size buffer if the label occupies the entire buffer. This out-of-bounds read is triggered during the display of the volume label. The fix involves explicitly null-terminating the buffer and ensuring the label is clamped to fit within the allocated space.
Affected products
- Linux Linux kernel 5.15 to 5.15.209, 6.1 to 6.1.175, 6.6 to 6.6.141, and others up to 6.9.x
Timeline
- 2026-06-24: advisory: CVE published by NVD
- 2026-05-23: patched: Fix committed to various stable branches
References
- https://git.kernel.org/stable/c/0b11fcbe80a59acdf58337d80ebb5f72201d73d6
- https://git.kernel.org/stable/c/32b0686369e0afbb3549a0d93e2d8517da84cd30
- https://git.kernel.org/stable/c/54d564b762389679e2f8fb9eeb20af7e82371e1c
- https://git.kernel.org/stable/c/5cd0707b81cb4589f00aec5c4c1288bd0980d2a4
- https://git.kernel.org/stable/c/6136bbb054f7ab9f51ae99915541633b18bcef90
- https://git.kernel.org/stable/c/a6cd43fe9b083fa23fe1595666d5738856cb261a
- https://git.kernel.org/stable/c/bc7a0c34c4ca259cfddf3bc18fc5b3c6411d26ed