Executive brief
The Linux kernel's NTFS3 filesystem driver contains an integer overflow vulnerability in MFT (Master File Table) cluster validation when processing specially crafted NTFS boot sectors. An attacker could supply a malformed NTFS filesystem image that bypasses security checks, potentially allowing invalid memory access patterns during mount operations.
Technical details
The vulnerability is an integer overflow (CWE-190) in the ntfs_init_from_boot() function of fs/ntfs3. When validating MFT cluster numbers read from the boot sector, the code performs u64 multiplication (mlcn * sct_per_clst) without overflow checks. With large mlcn values (e.g., near 2^62) and sct_per_clst up to 4096, the multiplication wraps around to 0, bypassing the bounds check against the volume size. The wrapping value is then used for subsequent block layer operations. The fix applies check_mul_overflow() to detect multiplication overflow before use, matching existing ntfs3 patterns in run.c. Exploitation requires providing a malicious NTFS image during mount (local attack vector), though current manifestation is mount failure rather than memory corruption.
Affected products
- Linux Linux kernel unspecified
Timeline
- 2026-09-17: disclosed