Executive brief
The Linux kernel's ntfs3 driver contains a vulnerability in how it parses NTFS disk structures during filesystem mount. A malformed NTFS disk image can trigger an infinite loop that hangs the mounting process and causes the system to panic, affecting any Linux system that automatically mounts untrusted USB drives or where users manually mount NTFS volumes with elevated privileges.
Technical details
The vulnerability is a missing bounds check in check_rstbl()'s free-chain walker (CWE-835: infinite loop). The function iterates through a singly-linked list of free entries in the RESTART_TABLE structure with only three guards: checking for end-of-list, an in-use marker, and out-of-bounds offsets. A crafted disk image can create a cycle (self-loop or A→B→A) where offsets are in-bounds and properly aligned, causing the loop to never terminate. The attack vector is network-adjacent (USB auto-mount) or local (CAP_SYS_ADMIN manual mount). A fix bounds the walker by rt->used (the legitimate entry count); any traversal exceeding this count is rejected as corrupt.
Affected products
- Linux Linux kernel <unknown
Timeline
- 2026-08-15: disclosed