Executive brief
The Linux kernel's NTFS file system driver contains an off-by-one error in bounds checking during mapping pairs decoding, which can allow reading one byte beyond the allocated attribute record. An attacker with access to a specially crafted NTFS file could trigger an out-of-bounds memory read, potentially exposing sensitive kernel memory or causing a system crash.
Technical details
The vulnerability exists in the ntfs_mapping_pairs_decompress() function in fs/ntfs/runlist.c. The function uses strict greater-than (>) checks to validate that mapping pair data bytes fit within an attribute record, but attr_end points one byte past the valid boundary. When buf + b exactly equals attr_end, the check incorrectly allows a read at buf[b], causing an out-of-bounds read one byte past the attribute boundary. This same off-by-one pattern appears in two separate bounds checks (LCN delta bytes and mapping pair data bytes). The fix changes both checks from > to >= to correctly reject accesses at the exact boundary. No special privileges or user interaction are required; a crafted NTFS file on a mounted filesystem can trigger the vulnerability. Patches are available in kernel versions after the fix date.
Affected products
- Linux Linux kernel 7.1 and later
Timeline
- 2026-08-15: disclosed
- 2026-06-06: patched: Upstream fix committed; backported to stable trees