Description

In the Linux kernel, the following vulnerability has been resolved: ntfs: validate resident attribute lists and harden the validator A base inode's $ATTRIBUTE_LIST is sanity-checked by load_attribute_list() only on the non-resident path; ntfs_read_locked_inode() copies a *resident* attribute list into ni->attr_list with a plain memcpy() and no validation at all. Every subsequent walk of ni->attr_list -- ntfs_external_attr_find(), ntfs_inode_attach_all_extents() and ntfs_attrlist_need() -- then trusts the entries are well-formed and reads attr_list_entry fixed-header fields (lowest_vcn at offset 8, mft_reference at offset 16, and the name) with bounds that assume validation already happened. A crafted resident attribute list therefore reaches those walks unvalidated and can drive out-of-bounds reads of the attribute-list buffer. load_attribute_list() itself reads ale->name_offset (offset 7), ale->mft_reference (offset 16) and the name length under only an "al < al_start + size" bound, so its own validation loop can over-read the fixed header of a truncated trailing entry by a few bytes. Factor the per-entry validation into ntfs_attr_list_entry_is_valid(), which requires each entry's fixed header (offsetof(struct attr_list_entry, name)) to be in range before any field is dereferenced, that ale->length is a multiple of 8 covering the fixed header plus the name, and that the entry is in use and carries a live MFT reference. ntfs_attr_list_is_valid() walks the buffer with it and checks the entries tile it exactly. Use the list validator in load_attribute_list() (replacing the open-coded loop, closing its own over-read) and on the resident path in ntfs_read_locked_inode() (which previously skipped validation entirely); patches 2/3 reuse the per-entry helper at the other two attribute-list walks.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-28T08:16:52.700Z",
  "pubdate": "2026-08-28T08:16:52.700Z",
  "executiveSummary": "This vulnerability is an out-of-bounds (OOB) memory read flaw residing within the Linux kernel's NTFS implementation.\nThe issue stems from insufficient validation of resident $ATTRIBUTE_LIST structures during inode initialization, specifically when an attribute list is small enough to be stored directly within the MFT record.\nBecause the kernel lacks validation logic for resident attribute lists, a crafted NTFS filesystem can supply malformed attribute data that bypasses bounds checks.\nThe impact includes potential kernel memory disclosure or system instability, as subsequent kernel functions operate on unverified, arbitrary offsets provided within the malicious attribute entries.\nSuccessful exploitation allows a local attacker, or one capable of mounting a malicious storage device, to trigger OOB reads of the attribute-list buffer, potentially leading to a kernel panic or unauthorized access to kernel heap data.",
  "technicalDetails": "The root cause of this vulnerability is a failure in the NTFS driver's inode initialization logic, specifically within the ntfs_read_locked_inode() function. When an inode's $ATTRIBUTE_LIST is resident—meaning it is contained entirely within the Master File Table (MFT) record—the kernel improperly employs a plain memcpy() to copy the structure into memory without performing any structural validation.\nThe NTFS driver relies on several subsequent helper functions, including ntfs_external_attr_find(), ntfs_inode_attach_all_extents(), and ntfs_attrlist_need(), to process these attribute lists. These functions operate under the invalid assumption that the attribute list entries have been fully vetted for consistency and bounds. They attempt to access fixed-header fields such as 'lowest_vcn' at offset 8 and 'mft_reference' at offset 16 without further verification.\nIn the original implementation, the load_attribute_list() function performed a superficial check by ensuring the entry resided within a total size bound (al < al_start + size). However, this failed to account for individual entry lengths or specific offset fields (such as 'ale->name_offset'), allowing an attacker to craft a truncated trailing entry where the fixed header could be read past the allocated buffer bounds.\nThe exploitation flow involves the following steps: 1) The attacker crafts an NTFS filesystem containing an inode with a malicious, resident $ATTRIBUTE_LIST. 2) The attacker mounts the filesystem, triggering the kernel to call ntfs_read_locked_inode(). 3) The kernel copies the malicious resident data directly into memory via memcpy(). 4) When the kernel later traverses the list, the absence of validation allows the attacker to supply entry lengths that extend beyond the actual buffer. 5) Subsequent calls to attribute parsing functions perform OOB reads when accessing offsets for name lengths, MFT references, or VCNs.\nThis creates an exploitation vector where the kernel's internal attribute-processing routines consume arbitrary memory locations specified by the malicious attribute list entry headers. This can result in system crashes due to memory access violations or the potential leakage of sensitive heap contents depending on the memory layout surrounding the attribute-list buffer."
}