Executive brief
The Linux kernel's NTFS filesystem driver had a bug in how it manages file metadata (attributes) stored in the Master File Table. When the kernel tried to free space by converting certain file attributes, it could incorrectly convert zero-length data attributes, causing the filesystem to be marked as corrupted. This could lead to data loss, system crashes, or the filesystem becoming inaccessible.
Technical details
This vulnerability exists in the NTFS filesystem driver's ntfs_resident_attr_resize() function in fs/ntfs/attrib.c. When resizing resident attributes, the function attempts to free MFT record space by converting other resident attributes to non-resident format. The bug is a logic error: the code did not exclude zero-length resident $DATA attributes from this conversion process. When a 0-byte $DATA attribute is converted to non-resident format, it creates a filesystem corruption that standard NTFS checking tools (fsck) detect and flag. The patch adds an explicit check to skip any $DATA attribute with zero value length during the conversion selection process. The vulnerability affects the NTFS driver across all kernel versions starting from v7.1.
Affected products
- Linux Linux kernel v7.1 and later
Timeline
- 2026-08-15: disclosed
- 2026-06-06: patched: Upstream commit 0aad21570197973af4a1b25b3fb8ed3aeb9e7670
- 2026-07-24: patched: Backported to stable kernels via commit ceb49c37250125d418410988f2376ed4d57a6706