Executive brief
The Linux kernel's NTFS3 filesystem driver has a bug in how it parses metadata when mounting NTFS volumes. When processing specially crafted filesystem images, the code can read memory beyond allocated boundaries. An attacker with administrator privileges who mounts a malicious NTFS image could trigger a kernel crash or information disclosure.
Technical details
The vulnerability is an out-of-bounds read in the ntfs_reparse_init() and ntfs_objid_init() functions in fs/ntfs3/fsntfs.c. These functions parse INDEX_ROOT attributes from NTFS metadata files without validating that the resident attribute buffer is large enough to hold the read data. The resident_data() helper accepts attributes with data_off == asize and data_size == 0, allowing a pointer to be returned that points past the allocated buffer. Reading the root->type and root->rule fields from such a pointer causes a slab out-of-bounds read. The fix uses resident_data_ex() with explicit size checking to validate the attribute is sufficiently large before parsing. Exploitation requires CAP_SYS_ADMIN capability (mounting a crafted filesystem image).
Affected products
- Linux Linux kernel multiple versions prior to fix commit 2064bc663f89e61b8681c1fb9d1ce445de72063d (released 2026-07-24)
Timeline
- 2026-09-16: disclosed: Published in NVD
- 2026-07-24: patched: Fix commit 2064bc663f89e61b8681c1fb9d1ce445de72063d
- 2026-06-10: other: Initial fix authored