Description

In the Linux kernel, the following vulnerability has been resolved: ntfs: reject invalid MFT LCNs from boot sector The NTFS boot sector stores the MFT and MFTMirr locations as unsigned 64-bit LCNs, but parse_ntfs_boot_sector() decoded them into an s64. A crafted high-bit value could therefore become negative and pass the existing upper-bound check. The invalid value then propagated into the MFT zone allocator and could result in an out-of-bounds access to lcn_empty_bits_per_page.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-09-11T20:19:46.313Z",
  "pubdate": "2026-09-11T20:19:46.313Z",
  "executiveSummary": "A critical integer handling vulnerability exists within the Linux kernel's NTFS filesystem implementation, specifically during the parsing of the NTFS boot sector.\nThe vulnerability is characterized by improper type casting of Logical Cluster Numbers (LCNs), leading to a potential out-of-bounds (OOB) memory access.\nAffected systems include any Linux kernel environments utilizing the NTFS driver where malicious or corrupted filesystem images can be mounted.\nThe risk implication is significant, as an attacker with the ability to provide a crafted filesystem image could trigger a kernel panic (denial of service) or potentially achieve arbitrary memory access through OOB conditions.\nExploitation requires the attacker to successfully mount a malicious NTFS partition, which generally necessitates local filesystem access or the ability to provide a removable storage device to the target system.",
  "technicalDetails": "The root cause of this vulnerability lies in the incorrect interpretation of 64-bit unsigned Logical Cluster Numbers (LCNs) retrieved from the NTFS boot sector. The function 'parse_ntfs_boot_sector()' is responsible for extracting the locations of the MFT (Master File Table) and MFTMirr. Although these values are defined as unsigned 64-bit integers in the filesystem specification, the implementation incorrectly decoded them into signed 64-bit integers ('s64').\nThis type-mismatch introduces an integer interpretation flaw. If a crafted filesystem image provides a very large unsigned LCN with the most significant bit (MSB) set, the conversion to an 's64' type results in a negative value. This negative value bypasses existing security checks designed to validate the upper bounds of the LCNs. By successfully evading the range validation, the malformed LCN is treated as a legitimate pointer reference during subsequent filesystem operations.\nThe attack flow proceeds as follows: An attacker creates a malicious NTFS image with an MFT or MFTMirr LCN possessing a high-bit value. Upon attempting to mount this filesystem, the kernel calls 'parse_ntfs_boot_sector()'. The function extracts the invalid value, performs the signed conversion, and passes the validation checks. The invalid LCN is subsequently propagated into the MFT zone allocator. During kernel execution, the MFT zone allocator uses this value to index into internal data structures, specifically 'lcn_empty_bits_per_page'. Because the LCN is effectively corrupted (negative or otherwise out-of-range), the indexing operation occurs outside the allocated memory bounds of the structure.\nThe post-exploitation impact includes the potential for an out-of-bounds read or write operation, which can lead to kernel-level memory corruption. This corruption is highly likely to cause a kernel panic (Denial of Service). In more advanced exploitation scenarios, if the OOB access allows for specific memory corruption primitives, an attacker might influence control flow or leak sensitive kernel information. The vulnerability does not specify a network exposure vector, but it is limited to scenarios involving physical or logical access to mount filesystem images, often restricted to users with sufficient privileges to execute mount commands, though this can be facilitated by auto-mounting functionality in desktop or server environments."
}