Description
In the Linux kernel, the following vulnerability has been resolved:

ntfs: bound $AttrDef table walk to the loaded table size

ntfs_attr_find_in_attrdef() walks the in-memory $AttrDef table, but the
loop condition bounds only the start of each entry, not the whole entry:

for (ad = vol->attrdef; (u8 *)ad - (u8 *)vol->attrdef <
vol->attrdef_size && ad->type; ++ad)

struct attr_def is 160 bytes; the guard reads ad->type at offset 128 and
the loop body reads further fields. vol->attrdef is kvzalloc(i_size),
where i_size is the on-disk $AttrDef data size, checked in
load_and_init_attrdef() only as 0 < i_size <= 0x7fffffff. A volume whose
$AttrDef data size is smaller than one entry (e.g. 120 bytes) makes the
read of ad->type run past the allocation. Creating a file reaches this
through ntfs_attr_size_bounds_check() and reads out of bounds:

BUG: KASAN: slab-out-of-bounds in ntfs_attr_find_in_attrdef+0x66/0xa0
Read of size 4 at addr ffff888005833280 by task init/1
ntfs_attr_find_in_attrdef
ntfs_attr_size_bounds_check
ntfs_attr_can_be_non_resident
ntfs_attr_add

Require the whole entry to lie within attrdef_size in the loop guard, and
reject at mount a $AttrDef too small to hold one attr_def entry.
Published: 2026-09-25
Score: n/a
EPSS: n/a
KEV: No
Impact: Denial of Service
Action: Apply Patch
AI Analysis

Impact

In the Linux kernel, the NTFS filesystem driver can read beyond the bounds of the $AttrDef table when the table size is smaller than one full entry. The loop boundary only checks the start of each entry, so a malformed table permits an out-of-bounds read of the ad->type field and subsequent fields. This memory corruption results in a kernel crash detected by KASAN and can also leak kernel memory contents. The defect is triggered when a volume with a too-small $AttrDef is opened, such as during mounting or when creating a file on that volume.

Affected Systems

Any Linux distribution that includes the stock NTFS driver and has not applied the commits referenced in the CVE documentation (c8504fc1 and 3e2ae47b) is potentially affected. The vulnerability is not limited to a particular kernel version; it applies to all kernels that compile the legacy NTFS module. Users of older kernel releases that have not yet received the patch should verify whether their kernel includes the fix before mounting NTFS volumes.

Risk and Exploitability

The CVSS and EPSS scores are not available, and the vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog. The impact is a kernel crash that causes denial of service. Because the flaw is triggered by a user-controllable NTFS volume, the likely attack vector is local or remote code that can mount or read a crafted NTFS filesystem. An exploit would involve presenting a malicious $AttrDef table that is smaller than the size of a single entry, causing the kernel to read past the allocated memory and crash the system.

Generated by OpenCVE AI on September 25, 2026 at 12:47 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update the Linux kernel to a version that contains the NTFS driver fix, such as one incorporating the commits c8504fc1 or 3e2ae47b.
  • If an immediate kernel update is not possible, avoid mounting or accessing NTFS volumes that could contain a malformed $AttrDef table.
  • Monitor system logs for KASAN, BUG, or kernel panic messages related to ntfs_attr_find_in_attrdef and take action if such messages appear.

Generated by OpenCVE AI on September 25, 2026 at 12:47 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 25 Sep 2026 13:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-125

Fri, 25 Sep 2026 10:45:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: ntfs: bound $AttrDef table walk to the loaded table size ntfs_attr_find_in_attrdef() walks the in-memory $AttrDef table, but the loop condition bounds only the start of each entry, not the whole entry: for (ad = vol->attrdef; (u8 *)ad - (u8 *)vol->attrdef < vol->attrdef_size && ad->type; ++ad) struct attr_def is 160 bytes; the guard reads ad->type at offset 128 and the loop body reads further fields. vol->attrdef is kvzalloc(i_size), where i_size is the on-disk $AttrDef data size, checked in load_and_init_attrdef() only as 0 < i_size <= 0x7fffffff. A volume whose $AttrDef data size is smaller than one entry (e.g. 120 bytes) makes the read of ad->type run past the allocation. Creating a file reaches this through ntfs_attr_size_bounds_check() and reads out of bounds: BUG: KASAN: slab-out-of-bounds in ntfs_attr_find_in_attrdef+0x66/0xa0 Read of size 4 at addr ffff888005833280 by task init/1 ntfs_attr_find_in_attrdef ntfs_attr_size_bounds_check ntfs_attr_can_be_non_resident ntfs_attr_add Require the whole entry to lie within attrdef_size in the loop guard, and reject at mount a $AttrDef too small to hold one attr_def entry.
Title ntfs: bound $AttrDef table walk to the loaded table size
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Subscriptions

Linux Linux Kernel
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-09-25T10:36:14.106Z

Reserved: 2026-09-25T10:25:14.319Z

Link: CVE-2026-98136

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-09-25T11:17:45.043

Modified: 2026-09-25T11:17:45.043

Link: CVE-2026-98136

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-25T13:30:18Z

Weaknesses