Executive brief
The Linux kernel's NTFS3 file system driver has a heap buffer overflow vulnerability in attribute list creation. When mounting a specially crafted NTFS image and performing file operations like setting extended attributes, an attacker can write beyond allocated memory boundaries. This could lead to privilege escalation, denial of service, or code execution on systems with NTFS support enabled.
Technical details
The vulnerability is a slab-out-of-bounds heap buffer write in the ni_create_attr_list() function. The function allocates a buffer sized to record_size but then iterates through attributes without checking buffer bounds; unnamed attributes in the list expand to 0x20 bytes instead of the on-disk 0x18 bytes, and the number of attributes is unbounded. A crafted NTFS image with many minimum-size nameless attributes causes the attribute list to exceed the allocated buffer size, triggering a heap overflow. The vulnerability is reachable by mounting a loop device with the malicious image and calling setxattr() (or other attribute-modifying operations). A patch sizes the buffer based on actual attributes present rather than assuming a single record_size is sufficient.
Affected products
- Linux Linux kernel 5.15+
Timeline
- 2026-09-16: disclosed