Executive brief
The Linux kernel's NTFS file system driver reads file references from directory index entries without proper validation. An attacker with a crafted NTFS disk image can exploit this to cause the kernel to misinterpret corrupted metadata as valid error codes, potentially leading to incorrect file lookups, data access violations, or kernel crashes when mounting or accessing NTFS volumes.
Technical details
The ntfs_lookup_inode_by_name() function in the NTFS driver returns Master File Table (MFT) references from untrusted directory index entries on disk. The vulnerability exists because error-marked MFT references (with the error bit set) are returned without validation, allowing callers to decode them with MREF_ERR() and consume arbitrary pseudo-errno values instead of treating the data as corrupted. A crafted NTFS image can set the MFT error bit while leaving low bits as an arbitrary value, bypassing error handling. The fix normalizes all error-marked MFT references to ERR_MREF(-EIO) at the source in ntfs_lookup_inode_by_name() across all four return paths, ensuring callers receive validated results. Attack vector is local (mounting a malicious NTFS filesystem); no authentication or network access required.
Affected products
- Linux Linux kernel Multiple versions through 6.x (NTFS driver)
Timeline
- 2026-08-15: disclosed
- 2026-07-06: patched: Upstream patch d97a36bae86a9a4021562ded2987f904e6bcb1d7 committed