Executive brief
The Linux kernel's NTFS filesystem driver parses boot sector metadata to locate the Master File Table (MFT), which is critical for reading NTFS volumes. A crafted NTFS boot sector can supply MFT location values that bypass validation checks by exploiting a signed/unsigned type confusion, allowing an attacker to trigger an out-of-bounds memory access. This could crash the system, corrupt data, or potentially enable privilege escalation on systems that mount untrusted NTFS volumes.
Technical details
The vulnerability is a type confusion in the NTFS boot sector parser (fs/ntfs/super.c, parse_ntfs_boot_sector function). The MFT and MFTMirr logical cluster numbers (LCNs) are stored in the boot sector as unsigned 64-bit values, but were decoded into a signed 64-bit (s64) variable. A malicious boot sector with a high-bit set can cause the decoded value to become negative, bypassing the upper-bound check (ll >= vol->nr_clusters). The invalid negative value then propagates into the MFT zone allocator, causing out-of-bounds access to the lcn_empty_bits_per_page array. The fix changes the variable type from s64 to u64 and adjusts comparison casts accordingly. Attack precondition: the attacker must control or supply the NTFS volume image (e.g., via USB, network share, or crafted disk image). No special privileges or authentication are required to mount and trigger the parser.
Affected products
- Linux Linux kernel multiple versions prior to fix (commit 8f8420b68a6f05ca2b03779d8208814ec539b9e5)
Timeline
- 2026-09-11: disclosed
- 2026-08-19: patched: Upstream fix committed by Hyunchul Lee