Executive brief
The Linux kernel's NTFS filesystem implementation contains a use-after-free vulnerability in the Master File Table (MFT) writeback handler. When the MFT data runlist is reallocated during concurrent allocation extension, the writeback code may dereference freed memory, causing kernel crashes or potential code execution. This affects systems using NTFS filesystems, particularly those with active MFT modifications and concurrent I/O operations.
Technical details
The vulnerability exists in ntfs_write_mft_block() where a runlist_element pointer is acquired under ni->runlist.lock, the lock is dropped, and then the pointer is dereferenced to read rl->length and rl->vcn for folio sizing decisions. Concurrent MFT allocation extension can merge a replacement runlist and free the old backing array (via ntfs_rl_realloc()) between the lookup and later dereference, causing access to freed memory. The attack vector requires no special privileges—any process that triggers both MFT writeback and concurrent MFT allocation can induce the race condition. The fix computes the remaining run length while the lock is held and uses that scalar value after unlock, eliminating the borrowed pointer dereference across the lock boundary. A KASAN report confirms the slab-use-after-free at ntfs_mft_writepages+0x1c8d/0x1fb0.
Affected products
- Linux Linux kernel Linux kernel versions with NTFS support (exact range not specified in advisory)
Timeline
- 2026-08-15: disclosed