Executive brief
The Linux kernel's NTFS filesystem driver lacks proper bounds checking when reading Extended Attributes (EA) metadata. An attacker with access to a malicious NTFS filesystem image can trigger an out-of-bounds memory read, potentially exposing sensitive kernel data or causing a denial-of-service through a crash. This affects systems that mount untrusted NTFS volumes.
Technical details
The vulnerability is a missing bounds check in the NTFS EA parsing code (ntfs_ea_lookup and ntfs_listxattr functions). Before accessing the next_entry_offset field of an EA entry structure, the code failed to verify that sufficient bytes remained in the EA buffer. An attacker can craft a malicious NTFS volume where EA entries are positioned near or beyond the buffer boundary, causing an out-of-bounds read when the code dereferences p_ea->next_entry_offset. The fix adds per-loop iteration bounds validation (checking ea_buf_size - offset < sizeof(struct ea_attr)) before accessing each EA entry. Exploitation requires the ability to mount a specially crafted NTFS filesystem, making this a local/adjacent vector. The patch was backported to stable kernels from v7.1 onward.
Affected products
- Linux Linux kernel v7.1 and later (before patch)
Timeline
- 2026-08-15: disclosed: Published on NVD
- 2026-06-06: patched: Upstream patch merged; stable backports from 2026-07-24 onward