Executive brief
A flaw in the Linux kernel's NTFS3 filesystem driver allows malformed NTFS volumes to bypass validation checks during attribute enumeration. An attacker with the ability to create or modify a malicious NTFS filesystem image could trigger memory safety issues or denial of service when the kernel mounts and processes the volume, potentially crashing the system or enabling further attacks.
Technical details
The vulnerability is an integer wraparound issue in the mi_enum_attr() function of the NTFS3 filesystem driver. The validation check "if (svcn > evcn + 1)" fails when evcn approaches U64_MAX because the addition wraps to 0, allowing out-of-range VCN (virtual cluster number) values to pass validation. An attacker can craft a malformed NTFS filesystem with svcn == 0 and evcn near U64_MAX to bypass the check. The fix validates that evcn falls within the volume's valid cluster range (sbi->used.bitmap.nbits) while preserving a special case for empty non-resident attributes (evcn == U64_MAX). The vulnerability requires local access to mount a malicious NTFS volume.
Affected products
- Linux kernel affected versions unspecified in advisory
Timeline
- 2026-09-17: disclosed