Executive brief
The Linux kernel's NTFS driver contains a buffer overflow vulnerability in how it validates restart-area metadata when mounting NTFS volumes. An attacker can craft a malicious NTFS disk image that, when mounted, causes the kernel to read memory far beyond the allocated buffer. This could lead to information disclosure or system crash when processing the compromised volume.
Technical details
The vulnerability is an integer truncation bug in ntfs_check_restart_area(). A u16 variable (ra_len) is used to hold the result of a calculation involving the on-disk log_clients count multiplied by 160 bytes (sizeof log_client_record). With attacker-controlled values, this product can exceed 65535, causing the u16 to truncate modulo 65536 and defeat the subsequent bounds check. The vulnerable code then passes this truncated length to ntfs_check_log_client_array(), which dereferences memory up to ~64 KiB beyond the allocated kvzalloc(system_page_size) buffer. The vulnerability is reachable at mount time via a crafted NTFS image and results in out-of-bounds reads. The fix widens ra_len and related variables to u32 to preserve the full computed value during validation.
Affected products
- Linux Linux kernel Classic NTFS driver (revived)
Timeline
- 2026-08-28: disclosed
- 2026-08-28: patched: Fix modifies ra_len and related variables from u16 to u32 to prevent integer truncation