Executive brief
The Linux kernel's NTFS filesystem driver contains a memory safety bug in the attribute-list parsing code that can be triggered by reading a specially crafted NTFS volume. When an attacker provides a malformed disk image with a carefully positioned attribute-list structure, the kernel reads memory past the allocated buffer boundary, potentially exposing sensitive kernel data or causing a system crash.
Technical details
This is an out-of-bounds read vulnerability in the NTFS attribute-list parsing logic within fs/ntfs/attrib.c. The vulnerable function ntfs_external_attr_find() performs lookahead validation of attribute-list entries using insufficient bounds checks: it only validates that bytes 0–6 of the next entry are within bounds and applies an attacker-controlled length field without proper alignment validation. The code then dereferences next_al_entry->lowest_vcn (offset 8) and name_offset, both of which can fall outside the allocated al_end boundary. A crafted NTFS volume with a specially positioned final attribute-list entry triggers a slab out-of-bounds read when the inode is parsed. The fix replaces the inadequate bounds checks with a call to ntfs_attr_list_entry_is_valid(), which properly validates the fixed header, length, and name boundaries before any dereference. The vulnerability requires no authentication; it is triggered automatically when mounting or reading from a malicious NTFS image.
Affected products
- Linux Linux kernel all versions with NTFS support (via fs/ntfs/attrib.c ntfs_external_attr_find())
Timeline
- 2026-08-28: disclosed: Public disclosure via NVD
- 2026-06-08: patched: Patch committed to linux-next (commit 344b18f389f9934d59c7b0cf3d20541ea2e0da58)