Description

In the Linux kernel, the following vulnerability has been resolved: ntfs: validate non-resident attribute offsets ntfs_attr_update_meta() shifts the attribute name when converting between non-sparse and sparse attributes. Converting to sparse also adds the compressed_size field before the name and mapping pairs, requiring eight additional bytes in the attribute record. However, the validator does not check that name_offset is within safe boundaries for these operations or that the additional space is available. A malicious MFT record could set name_offset such that: 1. The name is positioned at the very end of a non-sparse attribute. Converting to sparse would shift the name forward by 8 bytes, writing beyond the attribute boundary. 2. The name overlaps with the mapping pairs, causing corruption during conversion. Add validation to ensure: - For named attributes, name_offset is within valid bounds - Name does not extend beyond the attribute or overlap with mapping pairs - For non-sparse, non-compressed attributes, eight bytes are available after mapping_pairs_offset for the compressed_size field The space check also covers unnamed attributes, for which name_offset = 0 is valid and no name range needs to be checked.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-09-11T20:19:46.203Z",
  "pubdate": "2026-09-11T20:19:46.203Z",
  "executiveSummary": "The Linux kernel NTFS filesystem implementation contains an out-of-bounds write vulnerability stemming from improper validation of non-resident attribute offsets during attribute conversion operations. The issue specifically resides in the handling of sparse and compressed attributes within MFT (Master File Table) records.\nThe vulnerability allows a local attacker, capable of providing a specially crafted malicious NTFS image, to trigger memory corruption. By manipulating the name_offset and attribute record structure, an attacker can force the kernel to perform out-of-bounds writes when converting attributes between sparse and non-sparse states.\nThis flaw represents a significant risk to system integrity and stability, as successful exploitation results in kernel memory corruption. Such corruption can lead to denial-of-service conditions (system crashes) or potentially enable arbitrary code execution if an attacker can manipulate the surrounding memory structures. The vulnerability requires the mounting of a maliciously formatted filesystem, making it a threat primarily to systems processing untrusted or externally sourced storage media.",
  "technicalDetails": "The root cause of this vulnerability lies in the insufficient validation performed by ntfs_attr_update_meta() when processing non-resident attributes. Specifically, the kernel fails to verify that the 'name_offset' field in the attribute record points to a valid memory location that accounts for structural changes required during conversion between sparse and non-sparse formats.\nWhen an attribute is converted to a sparse representation, the NTFS implementation inserts a 'compressed_size' field immediately before the attribute name and mapping pairs. This operation necessitates an additional eight bytes of space within the attribute record. If the 'name_offset' is maliciously configured, the shift operation performed during this conversion causes the kernel to write past the allocated boundaries of the attribute record.\nThe attack flow proceeds as follows: 1) The attacker creates a malicious MFT record containing a non-resident, non-sparse attribute. 2) The 'name_offset' is set to a value where the attribute name is positioned at the extreme end of the current attribute record boundary. 3) The attacker triggers an operation (e.g., via a system call that forces an attribute update or sparse conversion) that invokes ntfs_attr_update_meta(). 4) The kernel attempts to insert the eight-byte 'compressed_size' field. 5) Due to the lack of boundary checks, the memory write operation for the shifted name and the new field overflows the attribute record buffer.\nFurthermore, the vulnerability allows for logical corruption if the 'name_offset' is manipulated to force an overlap between the attribute name and the attribute's mapping pairs. Because the kernel performs these updates without validating that the name remains within the attribute's bounds or avoids the mapping pairs offset, the filesystem metadata becomes corrupted. This corruption extends to both non-sparse and non-compressed attributes where the eight-byte space requirement is not verified against the available buffer size after the 'mapping_pairs_offset'.\nThe lack of these bounds checks means that the kernel trusts the MFT structure provided by the NTFS image without enforcing strict constraints on the relationship between offset fields and record lengths. Consequently, any process capable of mounting a filesystem can supply a malicious image to trigger this condition, leading to kernel-level memory corruption."
}