Executive brief
The Linux kernel's NTFS filesystem driver fails to properly validate attribute offsets in Master File Table (MFT) records when converting between sparse and non-sparse attributes. A malicious or corrupted NTFS volume could trigger an out-of-bounds memory write, causing kernel crashes or potentially enabling arbitrary code execution on systems that mount untrusted NTFS volumes.
Technical details
The vulnerability exists in the ntfs_non_resident_attr_value_is_valid() function in fs/ntfs/attrib.c. When processing non-resident NTFS attributes, the validator failed to check that the name_offset field is within valid boundaries or that sufficient space exists for attribute metadata operations. During conversion to sparse attributes via ntfs_attr_update_meta(), an 8-byte compressed_size field must be inserted, which can shift the attribute name forward. A malicious MFT record can set name_offset such that: (1) the name is positioned at the attribute boundary, causing a write beyond bounds when shifted, or (2) the name overlaps with mapping pairs, causing data corruption. The fix adds comprehensive bounds checking to ensure name_offset is valid, the name does not extend past the attribute or overlap with mapping pairs, and sufficient space exists for the compressed_size field. The vulnerability affects all kernel versions with NTFS support and requires local access (mounting a malicious volume).
Affected products
- Linux Linux kernel all versions with NTFS support
Timeline
- 2026-09-11: disclosed: CVE-2026-89611 published
- 2026-08-19: patched: Patch merged into Linux kernel stable