Executive brief
The Linux kernel's NTFS3 filesystem driver contains an out-of-bounds read vulnerability in its LZNT decompression function. When processing a corrupted or malicious NTFS disk image with invalid compressed data, the vulnerability can be triggered to read memory beyond array bounds, potentially exposing sensitive kernel information or causing a system crash.
Technical details
The vulnerability is a classic out-of-bounds array access in the decompress_lznt() function within fs/ntfs3/lznt.c. The decompress_chunk() function fails to validate array index bounds before accessing the s_max_off[] decompression table, allowing an attacker-controlled index to exceed the array size. The attack vector is local and requires mounting a specially crafted NTFS image; no authentication or network access is required. An attacker can read kernel memory or trigger a denial-of-service. The fix adds a bounds check: `while (index < ARRAY_SIZE(s_max_off) - 1 && unc + s_max_off[index] < up)` to prevent the out-of-bounds access. Patches are available in stable kernel branches.
Affected products
- Linux Linux kernel Multiple versions (NTFS3 filesystem driver)
Timeline
- 2026-08-28: disclosed
- 2026-04-18: patched: Patch committed by Tristan Madani; backported to stable branches in July 2026