Description

In the Linux kernel, the following vulnerability has been resolved: ntfs: verify run length exceeding volume boundary The mapping pairs decoder validates that the starting LCN is within the volume but does not check if the run extends beyond the volume boundary. A malformed NTFS image with a crafted mapping pairs array could cause the kernel to access memory beyond the volume boundary, potentially leading to memory corruption and privilege escalation. Add validation to ensure lcn + length stays within nr_clusters.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-09-11T20:19:46.093Z",
  "pubdate": "2026-09-11T20:19:46.093Z",
  "executiveSummary": "This vulnerability involves an out-of-bounds memory access flaw within the Linux kernel NTFS filesystem driver. The issue stems from the mapping pairs decoder failing to perform comprehensive boundary validation on disk run lengths.\nThe vulnerability allows a local attacker, capable of mounting a maliciously crafted NTFS filesystem image, to trigger memory corruption. By manipulating the mapping pairs array, an attacker can force the kernel to reference clusters outside the defined volume boundaries.\nSuccessful exploitation may result in kernel-level memory corruption, system instability, or potential privilege escalation by an authenticated user. The attack requires the ability to supply or mount a malformed filesystem image, which typically necessitates physical or logical access to the storage subsystem. The impact is significant as it compromises the integrity of kernel memory, potentially allowing an attacker to execute arbitrary code or bypass security restrictions through memory manipulation.\nThe risk is categorized as high for systems that process untrusted NTFS images, as the flaw bypasses existing sanity checks that only verify starting Logical Cluster Numbers (LCN) but ignore the aggregate extent of the run length.",
  "technicalDetails": "The root cause of this vulnerability lies in the insufficient input validation within the NTFS mapping pairs decoder function. The NTFS driver is responsible for translating file-based offsets into physical locations on the disk using a sequence of mapping pairs, which describe a run (a contiguous sequence of clusters) via a starting LCN and a length.\nIn the vulnerable implementation, the driver performs a sanity check on the starting LCN to ensure it resides within the valid addressable space of the volume. However, the logic fails to calculate the sum of the starting LCN and the provided length, thereby neglecting to verify if the ending point of the run exceeds the total number of clusters (nr_clusters) defined for the volume.\nThe attack flow proceeds as follows: 1. An attacker constructs a malicious NTFS filesystem image containing a deliberately malformed mapping pairs array. 2. Inside this array, a specific run is defined with a legitimate starting LCN but an artificially inflated length that causes the run to terminate beyond the actual volume boundary. 3. The victim system mounts the malicious image. 4. When the kernel attempts to access the file data associated with this malformed mapping, the decoder processes the out-of-bounds range without triggering a validation error. 5. The driver then performs memory operations (such as read or write) based on the calculated physical address, resulting in an out-of-bounds memory access.\nBecause the kernel operates in a high-privilege execution context, accessing memory outside the volume boundary can lead to the corruption of adjacent kernel data structures, sensitive kernel objects, or functional code pointers. If an attacker can control the contents of the memory being corrupted, they may achieve arbitrary code execution or elevate their privileges from a standard user to root. This exploitation path does not require network exposure, as it is triggered locally by mounting a storage device or image. The absence of a strict boundary check for (lcn + length) effectively bypasses security boundaries established by the NTFS driver's design."
}