Executive brief
The Linux kernel's NTFS filesystem driver contains an insufficient validation flaw in how it processes NTFS index root metadata structures. A local attacker with the ability to mount a specially crafted NTFS filesystem image can trigger a heap buffer overflow, leading to privilege escalation or denial of service on affected systems.
Technical details
The vulnerability exists in the NTFS filesystem driver's inode.c module, where $INDEX_ROOT header validation was inconsistently applied across directory and named index inode read paths. The root cause is improper bounds checking on the index header geometry—specifically, the code failed to centralize validation logic, allowing an attacker-controlled value_length field to bypass size checks. The vulnerability can be triggered by mounting a malicious NTFS image; no authentication or network access is required. An attacker can craft an inode with a specially formed $INDEX_ROOT attribute that bypasses the boundary checks, potentially causing a heap buffer overflow when the kernel processes index entries. A patch centralizes validation in a dedicated helper function (ntfs_index_root_inconsistent) that enforces stricter checks before processing index data, backported to stable kernels v7.1 and later.
Affected products
- Linux Linux kernel v7.1 and later (patched in commit 8b97b302f553a480fb76d2afd53cd6c0635a9dcd)
Timeline
- 2026-08-15: disclosed
- 2026-06-06: patched: Initial patch committed to mainline