Description

In the Linux kernel, the following vulnerability has been resolved: ntfs: harden runlist realloc size calculations Add a shared helper to safely convert runlist element counts to byte sizes using overflow checks, and use it in both ntfs_rl_realloc() and ntfs_rl_realloc_nofail().

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-15T13:18:02.637Z",
  "pubdate": "2026-08-15T13:18:02.637Z",
  "executiveSummary": "A vulnerability has been identified within the Linux kernel NTFS file system implementation related to runlist realloc size calculations.\nThe vulnerability type is an integer overflow that can lead to incorrect memory allocation sizing when resizing runlists.\nThe affected product is the Linux kernel NTFS file system driver, specifically within memory management functions handling runlist elements.\nThe risk implications involve potential memory corruption, denial of service, or arbitrary code execution if an attacker can manipulate malicious NTFS file system structures.\nAttacker capabilities require the ability to supply or mount a maliciously crafted NTFS volume or interact with file system operations that trigger runlist reallocations.\nExploitation requirements include mounting a specially crafted file system or triggering specific kernel code paths through system calls interacting with the vulnerable NTFS driver.",
  "technicalDetails": "The root cause of the vulnerability stems from unsafe arithmetic calculations when converting runlist element counts to byte sizes during memory reallocation procedures.\nSpecifically, functions such as ntfs_rl_realloc() and ntfs_rl_realloc_nofail() previously lacked adequate overflow checks when computing the required buffer sizes for runlists.\nThe vulnerable component comprises the NTFS runlist management logic within the Linux kernel source tree, responsible for mapping clusters to virtual block numbers.\nThe attack flow begins when a user or system mounts a maliciously formatted NTFS file system containing crafted metadata designed to trigger large runlist element counts.\nWhen the kernel attempts to resize the runlist via ntfs_rl_realloc() or ntfs_rl_realloc_nofail(), the lack of bounds checking on the size multiplication results in an integer overflow.\nConsequently, the calculated byte size wraps around to a small value, causing the memory allocator to allocate a buffer significantly smaller than requested.\nSubsequent write operations into the undersized buffer lead to a heap-based buffer overflow, corrupting adjacent kernel memory structures.\nPost-exploitation impact ranges from local denial of service via kernel panics to potential escalation of privilege if heap corruption can be reliably controlled by an attacker with local access or the ability to mount arbitrary file systems."
}