Executive brief
The Linux kernel's NTFS file system driver contains an out-of-bounds memory read vulnerability in its handling of NTFS attribute lists during file system mount. A user mounting a crafted NTFS volume can trigger an out-of-bounds read that may leak kernel memory, causing system crashes or exposing sensitive information. This affects systems that allow unprivileged users to mount NTFS file systems.
Technical details
The vulnerability is a bounds-checking bypass (CWE-125: out-of-bounds read) in the ntfs_read_inode_mount() function of fs/ntfs/inode.c. The code validates the Master File Table ($MFT) attribute list entry bounds with only a 6-byte check, then proceeds to read fields at offsets 8 and 16 without verifying they fall within the allowed buffer. An attacker-controlled al_entry->length value allows crafting short entries that pass the initial checks but cause reads past the buffer boundary. The vulnerability is only triggered when attr_list_size is a multiple of SECTOR_SIZE, as otherwise kernel allocation rounding provides accidental protection. The fix adds proper validation using ntfs_attr_list_entry_is_valid() before dereferencing the structure. The vulnerable code path is reachable from mount-time operations (unprivileged if the user can mount NTFS volumes) with no additional authentication required.
Affected products
- Linux Linux kernel multiple versions prior to fix commit 98634df5b1cb56c26299b7409227025ddb0167d8
Timeline
- 2026-09-04: disclosed: CVE published on NVD
- 2026-06-08: patched: Fix committed to Linux kernel by Namjae Jeon