Executive brief
The Linux kernel's NTFS file system driver contains a validation weakness that allows a maliciously crafted NTFS image to trigger an out-of-bounds memory read. An attacker can craft a specially formatted disk image and mount it on a vulnerable system, causing the kernel to read beyond allocated memory boundaries. This could leak sensitive kernel data or cause a system crash, affecting the confidentiality and availability of systems that mount untrusted NTFS volumes.
Technical details
The vulnerability is a slab-out-of-bounds read in the NTFS attribute lookup functions (ntfs_attr_find() and ntfs_external_attr_find()). The root cause is insufficient validation of embedded length fields in variable-length resident attributes, specifically in $FILE_NAME records where a small resident value_length can coexist with a large file_name_length field. An attacker can craft an NTFS image with this mismatch, causing callers to trust the embedded length field and read past the resident value bounds. The vulnerability was reproduced as a KASAN-detected slab-out-of-bounds read in the MFT record copy during ntfs_lookup() and related operations. Network attack is not applicable; exploitation requires mounting a crafted image locally. The fix adds a shared attribute value validator that enforces resident value bounds, minimum resident value sizes, and proper validation of variable-length fields before any attribute lookup returns.
Affected products
- Linux Linux kernel <6.10 (or affected stable branches)
Timeline
- 2026-08-15: disclosed
- 2026-08-15: patched