Executive brief
The Linux kernel's NTFS filesystem driver failed to properly validate attribute types during filesystem mount, allowing a crafted NTFS image to trigger memory corruption. An attacker could craft a malicious NTFS disk image that, when mounted, causes the kernel to misinterpret resident attributes as non-resident ones, leading to reads from incorrect memory locations. This could result in system crashes, privilege escalation, or arbitrary code execution during the mount process.
Technical details
The vulnerability exists in the ntfs_map_runlist_nolock() function in fs/ntfs/attrib.c. When looking up attribute extents (with ctx_needs_reset == true), the code expected the returned attribute to be non-resident but only issued a WARN_ON() when a resident attribute was found instead, allowing execution to continue unchecked. The code then accessed a->data.non_resident.highest_vcn on what was actually a resident attribute record, reading from the wrong union member and corrupting the VCN (Virtual Cluster Number) range validation. This occurs during the ntfs_fill_super() -> load_system_files() -> ntfs_empty_logfile() -> ntfs_map_runlist_nolock() call chain. The fix replaces the ineffective WARN_ON() with an explicit -EIO error return, matching the existing guard for the ctx != NULL branch. No patch bypass or exploitation mitigation is present in the vulnerable code; the fix must be applied.
Affected products
- Linux Linux kernel all versions with NTFS support (vulnerable since commit 495e90fa3348)
Timeline
- 2026-08-15: disclosed: Public disclosure via CVE-2026-72185
- 2026-07-02: patched: Fix committed upstream (commit b8d6c528e9d57d263fee1a648409f84a68b2561d)
- 2026-07-24: other: Patch merged to stable tree by Greg Kroah-Hartman