Executive brief
The Linux kernel's NTFS3 filesystem driver contains a memory corruption vulnerability triggered when processing specially crafted NTFS filesystem images. When a user mounts an attacker-supplied filesystem or interacts with malicious files, the kernel can write to memory it should not access, causing system crashes and potentially allowing code execution. This affects any Linux system that mounts NTFS volumes, including those that auto-mount removable media.
Technical details
The vulnerability is a heap buffer overflow in the indx_insert_into_buffer() function within fs/ntfs3/index.c. The root cause is missing validation of per-entry sizes returned by hdr_find_split() when walking NTFS INDEX_HDR entries. A crafted INDEX_HDR with used==total and a malicious entry reporting size=0xFFF0 passes initial validation but causes a u32 underflow in the memmove size calculation (used = used1 - to_copy - sp_size), resulting in a near-4 GiB write. The attack vector is local and requires only mounting an attacker-controlled filesystem image (USB, loopback, or auto-mounted media); a simple file creation (touch) triggers the crash. The fix validates that the split point offset plus its declared size does not exceed hdr1->used before proceeding with the operation.
Affected products
- Linux Linux kernel through 7.0.0-rc7 and potentially later
Timeline
- 2026-08-15: disclosed