Executive brief
The Linux kernel's NTFS filesystem driver contains a validation flaw in its mapping pairs decoder that can be triggered by a malformed NTFS disk image. An attacker with ability to supply a specially crafted NTFS volume could cause the kernel to read memory beyond the volume boundary, leading to information disclosure, memory corruption, and potential privilege escalation on systems that mount untrusted NTFS filesystems.
Technical details
The vulnerability is a missing bounds check in the NTFS mapping pairs decoder (fs/ntfs/runlist.c). While the code validates that the starting Logical Cluster Number (LCN) is within the volume, it fails to verify that the run length does not cause the run to extend beyond the volume boundary. An attacker can craft a malicious NTFS image with mapping pairs that have valid starting LCNs but runs that overflow beyond nr_clusters. This causes out-of-bounds memory access when the kernel processes the volume. The fix adds validation using check_add_overflow() and explicitly checks that lcn + length ≤ nr_clusters. This is a local/adjacent vector vulnerability requiring the attacker to supply or trick a user into mounting a malicious NTFS volume.
Affected products
- Linux Linux kernel 2.6.11 and later (all versions; patch committed 2026-08-19)
Timeline
- 2026-09-11: disclosed: Public disclosure via NVD
- 2026-08-19: patched: Upstream patch committed to Linux kernel
- 2026-09-07: advisory: Patch merged to stable kernel tree via Greg Kroah-Hartman