Executive brief
The Linux kernel's NTFS driver failed to protect critical system metadata files from user-space writes, allowing attackers with filesystem access to corrupt NTFS volumes and trigger kernel deadlocks. An NTFS volume exposed with system files visible can be rendered unusable through writes to files like $Bitmap or $MFT, affecting data integrity and system availability on affected systems using NTFS filesystems.
Technical details
The NTFS driver in the Linux kernel did not prevent userspace from writing to base metadata files (those with mft_no < FILE_first_user) such as $Bitmap and $MFT when they were exposed via show_sys_files. Writing to $Bitmap through userspace corrupts the volume and causes a deadlock in writeback code when the cluster allocator attempts to scan $Bitmap through the same inode's page cache. The vulnerability affects local attackers with write access to mounted NTFS volumes. The fix marks all base metadata regular files as immutable (S_IMMUTABLE flag) during inode read, causing the VFS to reject write, mmap, truncate, and unlink operations with -EPERM. Directories are excluded to keep the root and $Extend usable. Patches were applied starting with commit f72df3a4c33b64de3418ec74d1ad4f028e09d161 upstream.
Affected products
- Linux Linux kernel All versions prior to patch (commit f72df3a4c33b64de3418ec74d1ad4f028e09d161)
Timeline
- 2026-08-15: disclosed: Published on NVD
- 2026-07-06: patched: Patch commit f72df3a4c33b64de3418ec74d1ad4f028e09d161 (original), backported to stable trees