Description

In the Linux kernel, the following vulnerability has been resolved: ntfs3: fix out-of-bounds read in ntfs_dir_emit() and hdr_find_e() The bounds check in ntfs_dir_emit() compares fname->name_len (a character count) against e->size (a byte count) without accounting for the 2-byte-per-character UTF-16LE encoding or the ATTR_FILE_NAME header size: if (fname->name_len + sizeof(struct NTFS_DE) > le16_to_cpu(e->size)) This computes: name_len + 16 > e_size The correct check must account for the ATTR_FILE_NAME header (66 bytes before the name) and the UTF-16LE character size (2 bytes each): sizeof(NTFS_DE) + offsetof(ATTR_FILE_NAME, name) + name_len * sizeof(short) > e_size Which computes: 16 + 66 + name_len * 2 > e_size The correct calculation already exists as fname_full_size() in ntfs.h and is used in cmp_fnames(), namei.c, and fslog.c, but was not used in the readdir path. A crafted NTFS image with an index entry containing a small e->size but large fname->name_len bypasses the current check, causing ntfs_utf16_to_nls() to read past the entry boundary. Additionally, add a key_size validation in hdr_find_e() to ensure the declared key_size does not exceed the available entry data, preventing comparison functions from reading past entry boundaries on the lookup path.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-09-24T17:17:21.810Z",
  "pubdate": "2026-09-24T17:17:21.810Z",
  "executiveSummary": "The ntfs3 driver in the Linux kernel is susceptible to an out-of-bounds read vulnerability due to improper bounds checking within directory entry handling.\nThe flaw exists in ntfs_dir_emit() and hdr_find_e() functions, where the driver fails to correctly validate the size of NTFS file name attributes against the provided entry size.\nAn attacker can exploit this by providing a crafted NTFS image containing malicious directory entries. Successful exploitation allows for out-of-bounds memory access during directory traversal or lookup operations.\nThe vulnerability poses a significant risk to system stability and information confidentiality, as it may lead to kernel memory corruption or the disclosure of sensitive data through out-of-bounds reads.\nExploitation requires the mounting of a maliciously crafted NTFS filesystem, which can be achieved via local access or by enticing a user to mount an untrusted storage medium.",
  "technicalDetails": "The root cause of the vulnerability is an insufficient bounds check in the ntfs_dir_emit() function. The existing logic compared fname->name_len (a UTF-16 character count) directly against e->size (a byte count) after adding only the size of a NTFS_DE structure. This calculation failed to account for the static 66-byte offset of the ATTR_FILE_NAME header and the fact that UTF-16LE characters occupy two bytes each.\nSpecifically, the incorrect check: 'fname->name_len + sizeof(struct NTFS_DE) > le16_to_cpu(e->size)' evaluates as 'name_len + 16 > e_size', which drastically underestimates the required memory footprint for a directory entry. The correct implementation requires 'sizeof(NTFS_DE) + offsetof(ATTR_FILE_NAME, name) + (name_len * 2) > e_size', which aligns with the helper function fname_full_size() used elsewhere in the driver.\nThe attack flow begins when the kernel attempts to parse a directory entry from an NTFS image. An attacker crafts a filesystem where a specific index entry declares a large fname->name_len but a small e->size. When ntfs_dir_emit() processes this entry, the inadequate bounds check allows the execution to proceed, eventually passing an invalid length to ntfs_utf16_to_nls().\nDuring the conversion process in ntfs_utf16_to_nls(), the function attempts to read memory beyond the valid boundaries of the NTFS index entry, leading to an out-of-bounds read. This can result in an oops or kernel panic due to invalid memory access, or potentially leak sensitive information from adjacent kernel memory into userspace buffers.\nA secondary vector exists in hdr_find_e(), where the absence of key_size validation allows similar out-of-bounds reads during the lookup path. By manipulating the key_size field in the directory index, an attacker can force comparison functions to read past the entry boundary, further increasing the window for memory corruption or information disclosure.\nThis vulnerability affects the ntfs3 filesystem driver in the Linux kernel. It is a local exploitation vector, assuming the attacker has the capability to trigger the mounting of a malicious NTFS volume, which requires no specific network exposure but relies on interaction with the vulnerable kernel component via mount syscalls or automatic mounting mechanisms."
}