Executive brief
The Linux kernel's ntfs3 file system driver has a memory alignment issue in its iomap (I/O mapping) operations that handles NTFS file data. When inline file data is allocated without proper page alignment, kernel checks fail and cause system errors. Systems running affected kernel versions with NTFS3 support may experience crashes or file system corruption when accessing certain NTFS files.
Technical details
The ntfs3 driver's iomap implementation was using kmemdup() to allocate memory for inline file data, which does not guarantee page alignment. The iomap_inline_data_valid() check requires data to be page-aligned, causing validation failures. The fix replaces kmemdup() with alloc_page() to ensure proper page alignment, and updates corresponding deallocation calls from kfree() to __free_page(). The vulnerability affects the attribute data allocation path (fs/ntfs3/attrib.c) and iomap operations (fs/ntfs3/inode.c). A system with NTFS3 support must attempt to access an NTFS file with inline data to trigger the issue.
Affected products
- Linux Linux kernel Versions with ntfs3 driver support, patched in kernel 6.x and stable branches
Timeline
- 2026-09-04: disclosed
- 2026-05-11: patched: Upstream fix committed; backported to stable branches by 2026-07-24