Description

In the Linux kernel, the following vulnerability has been resolved: ntfs3: fix out-of-bounds read in decompress_lznt decompress_lznt() does not validate array index bounds before accessing the decompression table. A corrupted NTFS3 image with invalid compressed data can trigger an out-of-bounds read. Add index bounds checking to prevent the OOB access.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.8",
  "pubDate": "2026-08-28T08:16:43.580Z",
  "pubdate": "2026-08-28T08:16:43.580Z",
  "executiveSummary": "The Linux kernel NTFS3 driver contains an out-of-bounds (OOB) read vulnerability within the decompress_lznt() function. This issue arises from improper validation of array indices during the decompression of LZNT-compressed data streams. By providing a specially crafted or corrupted NTFS3 filesystem image, an attacker can trigger an out-of-bounds memory access. The vulnerability poses a risk to system stability and information confidentiality, as an unauthenticated attacker could potentially cause a kernel panic (Denial of Service) or leak sensitive kernel memory contents. Successful exploitation requires the system to mount a malicious filesystem, typically involving user interaction or the automated mounting of external storage devices.",
  "technicalDetails": "The vulnerability resides in the decompress_lznt function within the NTFS3 filesystem driver. The function is responsible for decompressing LZNT-compressed data streams found within NTFS files. The root cause of the flaw is the absence of rigorous bounds checking on the array indices used to index into the decompression table during the LZNT decoding process.\nSpecifically, the algorithm processes compressed chunks by reading metadata from the input buffer to determine the destination offset and the length of the data to be copied. Because the implementation fails to verify that these derived indices remain within the allocated memory bounds of the decompression table or the output buffer, a malicious input stream can force the code to perform read operations outside of the designated memory regions.\nThe attack flow proceeds as follows: An attacker creates a malformed NTFS3 filesystem image containing a file with intentionally corrupted LZNT-compressed data. This data is structured such that the decompression routine interprets values within the compressed stream as offsets or lengths that exceed the memory boundaries associated with the decompression table. When the kernel attempts to process the file—triggered by a mount operation or a subsequent read request—the lack of validation allows the function to access adjacent memory addresses.\nThis behavior results in an out-of-bounds read. Depending on the memory layout and the specific values being accessed, this can lead to two primary impact scenarios: First, the kernel may encounter a page fault if the out-of-bounds access reaches unmapped memory, resulting in a kernel panic and a complete Denial of Service (DoS) for the host system. Second, if the access remains within mapped kernel memory, an attacker might be able to influence the decompression process or, in more complex scenarios, potentially leak sensitive information from kernel memory into the userspace application attempting to read the file.\nThis vulnerability is localized to the ntfs3 driver. It does not require network exposure in the traditional sense, but it is highly effective against systems that automatically mount untrusted or removable storage media (e.g., USB drives). There are no specific privilege requirements for the filesystem read operation, though mounting a filesystem typically requires administrative or specific user privileges depending on system configuration."
}