Executive brief
The Linux kernel's NTFS filesystem driver did not properly validate resident-only attribute types when they were stored in non-resident format, allowing attackers to access or modify sensitive filesystem metadata. This could enable unauthorized access to file system data or cause system instability on systems with NTFS partitions mounted.
Technical details
The vulnerability exists in fs/ntfs/attrib.c where the NTFS attribute validator failed to reject non-resident records for attribute types that should always be resident-only (e.g., $STANDARD_INFORMATION, $FILE_NAME, $VOLUME_NAME, $INDEX_ROOT). Code paths in inode load, synchronization, and directory operations directly accessed the resident value offset without checking the non_resident flag, creating a type confusion condition. An attacker with the ability to craft or modify an NTFS filesystem image could bypass validation and cause out-of-bounds memory access or information disclosure. The fix introduces a helper function ntfs_attr_type_is_resident_only() that expands validation to reject non-resident forms of all resident-only attribute types, preventing the confusion.
Affected products
- Linux Linux kernel 7.1 and earlier
Timeline
- 2026-08-15: disclosed
- 2026-06-09: patched: Commit 097cdfd0a55df5af82c9753833f39a8bfadbcfcb