Executive brief
A vulnerability was identified in the Linux kernel's NTFS3 file system driver, which is used to read and write Windows-formatted drives. An attacker could use a specially crafted NTFS drive or file system image to cause a system crash or potentially gain unauthorized access to memory. This issue primarily affects systems that automatically mount or manually process untrusted NTFS storage media.
Technical details
An out-of-bounds (OOB) write vulnerability exists in the Linux kernel ntfs3 driver within the do_action() function in fs/ntfs3/fslog.c. The functions UpdateRecordDataRoot and UpdateRecordDataAllocation fail to validate the 'view.data_off' field from on-disk NTFS_DE structures against the entry size before performing a memmove operation. An attacker providing a malicious NTFS image with a large data_off value (e.g., 0xFFFC) can trigger a write beyond the allocated buffer. The fix introduces bounds checking to ensure view.data_off + dlen does not exceed the entry size.
Affected products
- Linux Linux kernel b46acd6a6a62 to 315d3a9a48b49f889da3d858a9307e677cb9e1bd
Timeline
- 2026-05-02: other: Initial patch proposed by researcher
- 2026-07-24: patched: Patched in stable branches by Greg Kroah-Hartman
- 2026-07-27: disclosed: CVE published
References
- https://git.kernel.org/stable/c/315d3a9a48b49f889da3d858a9307e677cb9e1bd
- https://git.kernel.org/stable/c/36feda687afebae24c472202694448738809c411
- https://git.kernel.org/stable/c/3e127829e57f5190f612412ece4541cb96d5ec7a
- https://git.kernel.org/stable/c/429d653ca641d38a78609b8f62e81a0a5c780a2d
- https://git.kernel.org/stable/c/b20e5a709d8bd190d6e4645606763c7423e694c1
- https://git.kernel.org/stable/c/be306b8d9143a9c076c804a7ca025d69caf9c448
- https://git.kernel.org/stable/c/d41b382068ca4e64e421f736cdd700095464b6ac