Executive brief
The Linux kernel's NTFS3 file system driver contains a buffer overflow vulnerability in its log replay analysis code. An attacker with access to mount a malformed NTFS3 image or partition can trigger a crash (denial of service) or potentially execute arbitrary code during the mount operation. This affects systems that process untrusted NTFS3 file system images.
Technical details
The vulnerability is a heap-based buffer overflow (slab-out-of-bounds write) in the fs/ntfs3 subsystem's log_replay() function during the analysis pass. The copy_lcns block fails to properly bound array writes to dp->page_lcns[] when processing malformed LRH (Log Record Header) entries. Specifically, when target_vcn equals dp->vcn + dp->lcns_follow - 1 and lrh->lcns_follow is greater than 1, the loop iterates past the allocated bounds of the page_lcns array. The vulnerability is triggered on the mount path when processing a specially crafted NTFS3 image; no prior authentication or user interaction is required beyond mounting the file system. The fix adds a boundary check to ensure j + lrh->lcns_follow does not exceed dp->lcns_follow.
Affected products
- Linux Linux kernel <UNKNOWN>
Timeline
- 2026-08-15: disclosed
- 2026-08-15: advisory