Description

In the Linux kernel, the following vulnerability has been resolved: ntfs: bound the free-cluster bitmap scan to the volume vol->lcn_empty_bits_per_page is sized from vol->nr_clusters at mount, but ntfs_cluster_alloc() bounds its scan of that array by the size of $Bitmap. Those are independent on-disk quantities and the mount-time check only rejects a $Bitmap that is too small, so an image whose $Bitmap covers more clusters than the volume has lets the scan index past the array. A run whose LCN lies in that gap takes the allocator straight there, since the caller passes the file's own last LCN as its locality hint. KASAN reports a slab out-of-bounds read when a file on such a volume is extended. Clamp the scan to what that array covers, mirroring the max_index calculation the mount-time scan already uses, and reject a decoded LCN at or beyond nr_clusters in the mapping pairs decoder. Conforming volumes are unaffected.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-09-11T20:19:46.543Z",
  "pubdate": "2026-09-11T20:19:46.543Z",
  "executiveSummary": "A vulnerability exists in the Linux kernel NTFS driver due to improper bounds checking of the free-cluster bitmap during disk operations. The vulnerability is classified as an out-of-bounds read, potentially leading to kernel memory exposure or system instability.\nThe issue arises from a discrepancy between the volume's actual cluster count and the $Bitmap attribute size on-disk. An attacker capable of providing or mounting a maliciously crafted NTFS filesystem image can trigger this flaw.\nThe impact includes potential information disclosure from kernel slab memory or a kernel panic, resulting in a denial-of-service condition. Successful exploitation requires an attacker to successfully mount a specifically formatted filesystem, which may necessitate administrative or root privileges depending on the environment. The risk is primarily relevant to systems that permit mounting untrusted external storage media or processing filesystems from unverified sources.",
  "technicalDetails": "The root cause of this vulnerability lies in the improper synchronization between the memory-mapped free-cluster bitmap and the on-disk NTFS volume metadata. Specifically, the Linux kernel NTFS driver initializes 'vol->lcn_empty_bits_per_page' based on 'vol->nr_clusters' at mount time. However, the 'ntfs_cluster_alloc()' function performs scans bound by the size of the $Bitmap attribute, rather than the physical cluster limit 'nr_clusters'.\nOn-disk, the $Bitmap size and the actual 'nr_clusters' are independent values. If an attacker crafts a malicious NTFS image where the $Bitmap attribute defines a range larger than the actual number of clusters on the volume, the driver fails to restrict the allocation scan to the valid cluster array. The memory allocation for 'lcn_empty_bits_per_page' is sized to 'nr_clusters', but the scanning logic ignores this limit.\nThe exploitation flow initiates when a file on such a maliciously crafted volume is extended. During file extension, 'ntfs_cluster_alloc()' is invoked to locate free clusters for the new data. The caller provides the file's last Logical Cluster Number (LCN) as a locality hint. If the LCN lies in the 'gap'—the region between the actual end of the volume and the bounds defined by the oversized $Bitmap—the allocator directs its search into this out-of-bounds area.\nAs the allocator attempts to read from or index into the 'lcn_empty_bits_per_page' array using these illegitimate LCNs, it accesses memory beyond the bounds of the allocated slab, resulting in an out-of-bounds read. KASAN (Kernel Address Sanitizer) instrumentation detects this access as an illegal memory read.\nFurthermore, the vulnerability is compounded by the lack of validation in the mapping pairs decoder. The decoder, responsible for interpreting the physical location of clusters, fails to reject LCN values that exceed 'nr_clusters'. Consequently, the system state becomes inconsistent, as the driver attempts to map data to clusters that do not exist within the volume's defined structure. This flaw leads to kernel memory corruption or unexpected system behavior upon accessing the malformed clusters, which the provided resolution addresses by enforcing strict clamping of scans to 'nr_clusters' and adding validation checks in the decoder."
}