Executive brief
The Linux kernel's NTFS filesystem driver contains a vulnerability in its mapping-pairs parser that can be triggered by a specially crafted NTFS volume. An attacker with the ability to create or modify an NTFS filesystem image could cause the kernel to misinterpret physical cluster locations, potentially leading to data corruption, denial of service, or unauthorized information disclosure when such a volume is mounted and accessed.
Technical details
The vulnerability is a signed integer overflow (CWE-190) in the NTFS mapping-pairs parser (fs/ntfs/runlist.c). The parser accumulates relative logical cluster number (LCN) deltas in a signed 64-bit integer. A malicious or corrupted NTFS attribute can drive the accumulated LCN to the maximum signed value (S64_MAX), and then a subsequent mapping-pairs entry adds an additional positive delta, causing signed overflow. Since signed overflow is undefined behavior in C, the compiler may generate unexpected code that stores incorrect cluster mappings. The fix detects overflow before storing the next run using check_add_overflow(). The attack requires the victim to mount a malicious NTFS volume, and affects the classic NTFS driver in Linux kernel versions 7.1 and earlier (note: the classic NTFS driver was removed in early 2024, replaced by NTFS3).
Affected products
- Linux Linux kernel 7.1 and earlier (classic NTFS driver)
Timeline
- 2026-08-15: disclosed
- 2026-07-24: patched