Executive brief
The Linux kernel's NTFS driver contains a use-after-free vulnerability in file allocation operations. An attacker with local file system access can trigger a race condition between file allocation and memory-mapped writes, causing the kernel to read freed memory and potentially crash the system or execute arbitrary code with kernel privileges.
Technical details
The vulnerability is a use-after-free in ntfs_attr_fallocate() arising from a race condition in runlist management. The function obtains a borrowed pointer to a runlist element while holding ni->runlist.lock for read, then releases the lock before dereferencing the element's fields (lcn, length, vcn). A concurrent mmap page_mkwrite path can reallocate and free the runlist array via ntfs_rl_realloc() and ntfs_runlists_merge(), causing the fallocate path to read freed memory. The fix snapshots the required runlist fields while the lock is held and operates on those scalar copies after unlocking. Attack requires local file system access and can be triggered by concurrent fallocate and mmap operations on an NTFS volume.
Affected products
- Linux Linux kernel <unknown
Timeline
- 2026-08-15: disclosed
- 2026-08-15: advisory