Executive brief
The Linux kernel's NTFS file system driver fails to validate the structure of index root metadata during file lookups. An attacker with control over an NTFS volume or ability to craft a malicious NTFS image could exploit this to corrupt kernel memory or trigger a denial of service, potentially compromising system stability or enabling privilege escalation.
Technical details
This vulnerability is a validation bypass in the NTFS driver (fs/ntfs/attrib.c). The kernel reads index header fields from the resident $INDEX_ROOT attribute and consumes them without verifying invariants such as 8-byte alignment, field boundary consistency (entries_offset, index_length, allocated_size), and sufficient space for entry headers. An attacker can craft a malicious NTFS volume with an inconsistent or corrupt $INDEX_ROOT structure. During file lookup or directory traversal, the kernel would process the invalid metadata, leading to out-of-bounds memory access, information disclosure, or heap corruption. The fix adds comprehensive validation of all index header fields before the attribute is returned to callers, ensuring alignment and consistency constraints are met.
Affected products
- Linux Linux Kernel 7.1 and later
Timeline
- 2026-08-15: disclosed
- 2026-06-09: patched