Executive brief
The Linux kernel's NTFS filesystem driver contains an integer overflow vulnerability in memory allocation routines used to resize runlist data structures. An attacker with the ability to mount a malicious NTFS filesystem image could trigger the overflow, potentially leading to kernel memory corruption, denial of service, or privilege escalation.
Technical details
The vulnerability exists in the ntfs_rl_realloc() and ntfs_rl_realloc_nofail() functions in fs/ntfs/runlist.c, where runlist element counts are multiplied by sizeof(struct runlist_element) without proper overflow checking. An attacker can supply a crafted NTFS filesystem with large runlist element counts that cause the multiplication to wrap around, resulting in allocation of a smaller-than-expected buffer. Subsequent memcpy() operations write beyond the allocated buffer, corrupting kernel memory. The fix adds check_mul_overflow() macros to detect and reject such malicious inputs before allocation occurs. The vulnerability is reachable via any NTFS mount operation from an unprivileged user context if NTFS mounting is permitted.
Affected products
- Linux Linux kernel all versions with NTFS support (fixed in upstream commit 8bed376124ab4505b70083a2b91f2c7ef6d51e24)
Timeline
- 2026-08-15: disclosed
- 2026-07-10: patched: Upstream patch committed by Namjae Jeon