Description
In the Linux kernel, the following vulnerability has been resolved:

ntfs: bound $AttrDef table walk to the loaded table size

ntfs_attr_find_in_attrdef() walks the in-memory $AttrDef table, but the
loop condition bounds only the start of each entry, not the whole entry:

for (ad = vol->attrdef; (u8 *)ad - (u8 *)vol->attrdef <
vol->attrdef_size && ad->type; ++ad)

struct attr_def is 160 bytes; the guard reads ad->type at offset 128 and
the loop body reads further fields. vol->attrdef is kvzalloc(i_size),
where i_size is the on-disk $AttrDef data size, checked in
load_and_init_attrdef() only as 0 < i_size <= 0x7fffffff. A volume whose
$AttrDef data size is smaller than one entry (e.g. 120 bytes) makes the
read of ad->type run past the allocation. Creating a file reaches this
through ntfs_attr_size_bounds_check() and reads out of bounds:

BUG: KASAN: slab-out-of-bounds in ntfs_attr_find_in_attrdef+0x66/0xa0
Read of size 4 at addr ffff888005833280 by task init/1
ntfs_attr_find_in_attrdef
ntfs_attr_size_bounds_check
ntfs_attr_can_be_non_resident
ntfs_attr_add

Require the whole entry to lie within attrdef_size in the loop guard, and
reject at mount a $AttrDef too small to hold one attr_def entry.
Published: 2026-09-25
Score: 7.1 High
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service
Action: Apply Patch
AI Analysis

Impact

The vulnerability stems from the NTFS filesystem driver in the Linux kernel, which walks the in‑memory $AttrDef table without fully bounding the size of each entry. If a volume’s $AttrDef data is smaller than one full entry, the loop reads past the allocated memory when accessing ad->type and subsequent fields. This out‑of‑bounds read triggers a kernel crash, as indicated by the KASAN message and BUG log, resulting in system instability. The flaw is purely a memory corruption leading to a crash; no evidence in the CVE description indicates leaking kernel memory contents.

Affected Systems

Any Linux distribution that includes the stock NTFS driver and has not applied the commits referenced in the CVE documentation (c8504fc1 and 3e2ae47b) is potentially affected. The vulnerability is not limited to a particular kernel version; it applies to all kernels that compile the legacy NTFS module. Users of older kernel releases that have not yet received the patch should verify whether their kernel includes the fix before mounting NTFS volumes.

Risk and Exploitability

The CVSS score is 7.1 and the EPSS score is below 1%. The vulnerability is not listed in CISA’s KEV catalog. An attack could exploit a crafted NTFS volume whose $AttrDef table size is smaller than a single entry. The kernel would attempt to read beyond the allocated buffer, causing a crash. The attack vector is local or remote code that can mount or read a malicious NTFS filesystem; this inference is based on the fact that the vulnerability is triggered by the contents of an NTFS volume.

Generated by OpenCVE AI on October 8, 2026 at 19:54 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update the Linux kernel to a version that contains the NTFS driver fix, such as one incorporating the commits c8504fc1 or 3e2ae47b.
  • If an immediate kernel update is not possible, avoid mounting or accessing NTFS volumes that could contain a malformed $AttrDef table.
  • Monitor system logs for KASAN, BUG, or kernel panic messages related to ntfs_attr_find_in_attrdef and take action if such messages appear.

Generated by OpenCVE AI on October 8, 2026 at 19:54 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 08 Oct 2026 18:00:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:o:linux:linux_kernel:7.3:rc1:*:*:*:*:*:*
Metrics cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}

 cvssV3_1

{'score': 7.1, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H'}

Tue, 29 Sep 2026 13:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}

threat_severity

Moderate

Fri, 25 Sep 2026 13:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-125

Fri, 25 Sep 2026 10:45:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: ntfs: bound $AttrDef table walk to the loaded table size ntfs_attr_find_in_attrdef() walks the in-memory $AttrDef table, but the loop condition bounds only the start of each entry, not the whole entry: for (ad = vol->attrdef; (u8 *)ad - (u8 *)vol->attrdef < vol->attrdef_size && ad->type; ++ad) struct attr_def is 160 bytes; the guard reads ad->type at offset 128 and the loop body reads further fields. vol->attrdef is kvzalloc(i_size), where i_size is the on-disk $AttrDef data size, checked in load_and_init_attrdef() only as 0 < i_size <= 0x7fffffff. A volume whose $AttrDef data size is smaller than one entry (e.g. 120 bytes) makes the read of ad->type run past the allocation. Creating a file reaches this through ntfs_attr_size_bounds_check() and reads out of bounds: BUG: KASAN: slab-out-of-bounds in ntfs_attr_find_in_attrdef+0x66/0xa0 Read of size 4 at addr ffff888005833280 by task init/1 ntfs_attr_find_in_attrdef ntfs_attr_size_bounds_check ntfs_attr_can_be_non_resident ntfs_attr_add Require the whole entry to lie within attrdef_size in the loop guard, and reject at mount a $AttrDef too small to hold one attr_def entry.
Title ntfs: bound $AttrDef table walk to the loaded table size
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Subscriptions

Linux Linux Kernel
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-09-25T10:36:14.106Z

Reserved: 2026-09-25T10:25:14.319Z

Link: CVE-2026-98136

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Analyzed

Published: 2026-09-25T11:17:45.043

Modified: 2026-10-08T17:54:12.217

Link: CVE-2026-98136

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-09-25T00:00:00Z

Links: CVE-2026-98136 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-10-08T20:00:02Z

Weaknesses