Executive brief
The Linux kernel's NTFS filesystem implementation contains a vulnerability in the Master File Table (MFT) record allocation code that can read data outside allocated memory bounds. When reusing a free MFT record, the code reads an untrusted offset value from disk without validation, allowing a corrupted NTFS filesystem image to trigger memory access violations. An attacker with the ability to provide a malicious NTFS filesystem could trigger a denial of service or potentially expose kernel memory.
Technical details
The vulnerability is a buffer over-read in the ntfs_mft_record_alloc() function (fs/ntfs/mft.c). When reusing a free MFT record, the code reads the update sequence number (usn) directly from an untrusted offset (m->usa_ofs) in the on-disk record without validation. The offset value is controlled by the filesystem image itself and is not validated before being used to calculate a pointer and dereference it. A corrupted NTFS image can set usa_ofs past the end of the 4096-byte MFT record, causing the two-byte read to access memory beyond the folio bounds, triggering a KASAN use-after-free error. The fix validates that usa_ofs is even-aligned and within the MFT record size before using it; otherwise it leaves usn zero. The vulnerability affects all Linux kernel versions that support NTFS filesystem operations through the reused MFT record allocation path.
Affected products
- Linux Linux kernel multiple versions with NTFS support
Timeline
- 2026-09-17: disclosed: CVE-2026-90117 published on NVD
- 2026-08-20: patched: Fix committed upstream as commit 81684340963da2e898eabb8c1e274433d9375bc6
- 2026-09-14: patched: Fix included in stable kernel via commit ea5a3c30710710c1dc5e483d3313309ec2e868f7