Executive brief
The Linux kernel's NTFS file system implementation contained improper handling of memory page mapping operations during compressed data decompression. This could lead to memory corruption or crashes when reading compressed NTFS files, particularly on systems with high memory configurations. The fix ensures that page mappings are properly allocated and freed using the correct kernel APIs.
Technical details
The vulnerability exists in the NTFS compression handling code (fs/ntfs/compress.c), specifically in the ntfs_decompress() and ntfs_read_compressed_block() functions. The bug involves discarding the address returned by kmap_local_page() and later attempting to access or unmap pages using page_address() instead. This is invalid for highmem pages, as local mappings must be unmapped using the address originally returned by kmap_local_page(). The fix corrects the code by properly mapping pages only during current sub-block processing and replacing direct page_address() calls with proper memory access helpers (memcpy_from_page(), memcpy_to_page(), memzero_page()). This is a logic error that could affect any system attempting to read compressed NTFS file system data, with higher risk on configurations with high memory support enabled.
Affected products
- Linux Linux kernel Multiple versions (introduced in commit 495e90fa3348, patched in 6.x and earlier stable branches)
Timeline
- 2026-09-17: disclosed: Published on NVD
- 2026-06-15: patched: Original fix commit 6e03fbd5f772ad24ea64f7632e4d0d73184787ca by Namjae Jeon
- 2026-09-14: patched: Backported to stable kernels via commit 950e2ecc7aec21af24b05bc661a097a81c670409