Executive brief
The Linux kernel's NTFS filesystem driver contains a heap buffer overflow vulnerability in the ntfs_ir_to_ib() function. An attacker who provides a specially crafted NTFS filesystem image can trigger an out-of-bounds write in kernel memory, potentially leading to denial of service, information disclosure, or privilege escalation depending on kernel configuration and memory layout.
Technical details
The vulnerability is a heap out-of-bounds (OOB) write in ntfs_ir_to_ib(), which copies index entries from an index_root structure into a freshly allocated index block buffer without validating that the entries fit within the available space. The function uses memcpy() without bounds checking, while the validator ntfs_index_root_inconsistent() only checks the logical consistency of the index_root structure itself and does not cross-check entry sizes against index_block_size. The vulnerability can only be triggered by a crafted NTFS filesystem image (not considered a kernel threat model per the advisory), and the fix adds bounds validation in ntfs_ir_to_ib() to verify entries fit before copying. This prevents writing past the end of the allocated buffer.
Affected products
- Linux Linux kernel <UNKNOWN>
Timeline
- 2026-09-17: disclosed