Description

In the Linux kernel, the following vulnerability has been resolved: ntfs: reject invalid empty mapping pairs Reject an attribute with empty mapping pairs if it has inconsistent highest VCN and size.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-09-11T20:19:46.433Z",
  "pubdate": "2026-09-11T20:19:46.433Z",
  "executiveSummary": "This vulnerability involves an improper validation of attribute mapping pairs within the Linux kernel NTFS filesystem implementation. The flaw allows for the processing of corrupted or maliciously crafted NTFS attributes where empty mapping pairs are combined with inconsistent highest Virtual Cluster Number (VCN) and size metadata.\nThe vulnerability type is categorized as an improper input validation issue, which can lead to memory corruption or undefined behavior during file system operations. If exploited, an attacker could potentially trigger kernel-level crashes, resulting in a denial-of-service condition.\nThe scope of impact is restricted to systems utilizing the NTFS driver within the Linux kernel. Successful exploitation typically requires the mounting of a maliciously crafted filesystem or disk image. No specific network exposure is inherent to this vulnerability, as it requires interaction with a filesystem, making it a local or physical attack vector. System integrity and availability are the primary security pillars affected by this flaw.",
  "technicalDetails": "The root cause of this vulnerability lies in the insufficient integrity checking of NTFS attribute structures during the parsing of mapping pairs. Within the NTFS filesystem, data is stored in clusters, and the mapping pairs array defines the location of these clusters on the storage medium. An attribute may contain a mapping pairs list that describes the extents of the data run.\nThe vulnerability arises when the filesystem driver encounters an attribute that declares itself to have 'empty' mapping pairs while simultaneously providing metadata indicating a non-zero highest VCN or an inconsistent total size. The Linux kernel NTFS driver previously failed to perform a cross-validation between the presence of mapping data and the reported extent bounds. By supplying an attribute with an empty mapping structure but an inflated or contradictory size field, the parser may attempt to perform arithmetic operations on invalid data structures or reference out-of-bounds memory addresses.\nThe attack flow follows a structured path: first, an attacker prepares a malicious filesystem image containing a manipulated NTFS File Record. This record includes an attribute where the mapping pairs are explicitly empty or malformed. Second, the attacker triggers the vulnerability by mounting this filesystem or accessing the specific file through a system call such as read() or stat().\nDuring the parsing phase, the kernel function responsible for iterating through mapping pairs processes the attribute. Because the logic assumes that any attribute with size metadata must contain valid mapping entries, the inconsistency leads to an incorrect calculation of the attribute's extent, potentially causing the kernel to read beyond the intended buffer or perform arithmetic operations on zero-initialized fields that do not map to actual disk clusters.\nThis can lead to a kernel panic or a null pointer dereference, effectively crashing the system. In more complex scenarios, this type of validation failure could potentially be leveraged for memory disclosure if the kernel erroneously reads kernel stack or heap memory into a user-accessible buffer during the failed parsing attempt. The vulnerability is triggered during the standard filesystem metadata parsing process, requiring no specific user-space privileges other than the ability to trigger a filesystem mount or read operation."
}