Executive brief
A vulnerability was identified in the Linux kernel's NTFS3 file system driver, which is used to read and write Windows-formatted drives. Under specific conditions involving compressed or sparse files, the system may fail to correctly track file data locations across different segments. This can lead to internal kernel errors (kernel warnings) and potential instability or data handling issues when accessing these specific file types.
Technical details
A vulnerability in the Linux kernel's ntfs3 file system driver arises from a missing run load for vcn0 in the `attr_data_get_block_locked()` function. When handling compressed or sparse attributes with frame-aligned clusters, the virtual cluster number (vcn) is rounded down, potentially placing vcn and vcn0 in different attribute segments. The driver fails to verify if the segment containing vcn0 is loaded into the in-memory run list before performing a lookup. This results in `run_lookup_entry()` returning `SPARSE_LCN` incorrectly and triggering a `WARN_ON(1)`. The issue has been resolved by adding a check to ensure the attribute segment containing vcn0 is found and loaded before the lookup occurs.
Affected products
- Linux Linux Kernel 6.1.132, 6.2, 7.0.10
Timeline
- 2026-03-19: other: Vulnerability fixed in source code
- 2026-06-24: disclosed: CVE published