Description

In the Linux kernel, the following vulnerability has been resolved: ntfs: bound the look-ahead attribute-list entry in ntfs_external_attr_find() When resolving an attribute lookup with a non-zero @lowest_vcn, ntfs_external_attr_find() peeks at the next $ATTRIBUTE_LIST entry to decide whether to keep searching, but bounds that not-yet-validated entry only with "(u8 *)next_al_entry + 6 < al_end" (which proves just bytes 0..6 are in range) and "(u8 *)next_al_entry + length <= al_end" with an attacker-controlled, non-8-aligned length. It then reads next_al_entry->lowest_vcn (an __le64 at offset 8) and the name at next_al_entry->name_offset, both of which can lie past al_end -- the exact end of the kvmalloc'd attribute-list buffer (allocated at the on-disk attr_list_size, no rounding). A crafted on-disk $ATTRIBUTE_LIST whose last entry sits a few bytes before al_end therefore yields a slab out-of-bounds read when the inode is read. Validate the look-ahead entry with ntfs_attr_list_entry_is_valid() (added in patch 1/3) before dereferencing lowest_vcn and the name, so the same fixed-header, length and name bounds the main attribute-list walk uses now guard this read too.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-28T08:16:52.607Z",
  "pubdate": "2026-08-28T08:16:52.607Z",
  "executiveSummary": "A critical memory safety vulnerability exists in the Linux kernel NTFS filesystem driver within the ntfs_external_attr_find() function.\nThe vulnerability is classified as an out-of-bounds (OOB) read, occurring when the kernel incorrectly validates the bounds of attribute-list entries during attribute lookups.\nThe flaw allows a local attacker to provide a maliciously crafted $ATTRIBUTE_LIST on an NTFS partition, which, when parsed, causes the kernel to read memory beyond the boundaries of the allocated slab buffer.\nThis vulnerability poses a significant risk to system stability and information confidentiality, as it could facilitate kernel-level data leakage. Exploitation requires the attacker to have the ability to mount or interact with a maliciously prepared NTFS filesystem. No authentication is inherently required if the system automatically mounts external media, though exploitation is limited to local or physical access vectors.",
  "technicalDetails": "The root cause of this vulnerability lies in an insufficient bounds check within ntfs_external_attr_find() when performing a look-ahead operation on $ATTRIBUTE_LIST entries.\nDuring the resolution of an attribute lookup involving a non-zero @lowest_vcn, the function attempts to peek at the subsequent attribute-list entry to determine the continuity of the search. The validation logic only ensures that the first 6 bytes of the 'next_al_entry' pointer reside within the buffer, and that the provided length does not exceed the total size of the attribute list (al_end).\nCrucially, the code fails to account for the internal structure of the next_al_entry, specifically the 'lowest_vcn' field (an __le64 at offset 8) and the attribute name offset. Because the length field in the attribute-list entry is attacker-controlled and not strictly 8-byte aligned, it is possible for a malformed entry placed near the boundary of the allocated buffer to cause the kernel to access memory past the end of the slab allocation.\nThe attack flow proceeds as follows: 1) An attacker creates a crafted NTFS partition containing a malicious $ATTRIBUTE_LIST. 2) The attacker ensures the final entry in the list is positioned such that its length field, while technically staying within the al_end bound, causes the calculation for the next entry's fields (specifically the lowest_vcn and name) to reference memory beyond the actual allocation (kvmalloc'd size). 3) When the Linux kernel mounts the filesystem or accesses an inode requiring attribute-list traversal, ntfs_external_attr_find() is invoked. 4) The function dereferences the out-of-bounds memory addresses, resulting in a slab OOB read. 5) This operation may lead to a kernel panic (Denial of Service) or the exposure of sensitive adjacent slab data to user space depending on how the system handles the invalid read operations."
}