Executive brief
The Linux kernel's NTFS filesystem driver did not properly validate the structure and geometry of index block headers when processing directory entries. An attacker with local access to a malformed NTFS filesystem could exploit this flaw to read kernel memory or cause denial of service, potentially leading to privilege escalation or system crash.
Technical details
This vulnerability exists in the NTFS filesystem driver (fs/ntfs/) in the Linux kernel. The root cause is insufficient validation of INDEX_HEADER geometry in INDX blocks during directory traversal operations. The ntfs_lookup_inode_by_name() function and related code did not properly check the consistency of index block structure fields (entries_offset, index_length, allocated_size) before dereferencing pointers into those blocks. An attacker can craft a malicious NTFS filesystem image and mount it locally to trigger out-of-bounds memory access, information disclosure, or kernel panic. The vulnerability was fixed by introducing stricter validation in a new ntfs_index_header_inconsistent() function and calling it from ntfs_lookup_inode_by_name(). Patches are available in kernel v7.2 and later stable branches.
Affected products
- Linux Linux kernel v7.1 and earlier
Timeline
- 2026-08-15: disclosed
- 2026-05-23: patched: Fix committed upstream; backported to stable branches by 2026-07-24