Description

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: validate index entry key bounds [BUG] A malformed NTFS directory index entry can advertise a key_size larger than the bytes actually present in its NTFS_DE payload. Directory lookup then passes that malformed key to cmp_fnames(), which can read past the end of the kmalloc'ed index buffer. BUG: KASAN: slab-out-of-bounds in fname_full_size fs/ntfs3/ntfs.h:590 [inline] BUG: KASAN: slab-out-of-bounds in cmp_fnames+0x1ea/0x230 fs/ntfs3/index.c:46 Read of size 1 at addr ffff88801c313018 by task syz.6.3365/9279 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0xbe/0x130 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0xd1/0x650 mm/kasan/report.c:482 kasan_report+0xfb/0x140 mm/kasan/report.c:595 __asan_report_load1_noabort+0x14/0x30 mm/kasan/report_generic.c:378 fname_full_size fs/ntfs3/ntfs.h:590 [inline] cmp_fnames+0x1ea/0x230 fs/ntfs3/index.c:46 hdr_find_e.isra.0+0x3ed/0x670 fs/ntfs3/index.c:762 indx_find+0x4b5/0x900 fs/ntfs3/index.c:1186 dir_search_u+0x2c0/0x460 fs/ntfs3/dir.c:254 ntfs_lookup+0x1cc/0x2a0 fs/ntfs3/namei.c:85 __lookup_slow+0x241/0x450 fs/namei.c:1816 lookup_slow fs/namei.c:1833 [inline] walk_component+0x31c/0x570 fs/namei.c:2151 link_path_walk+0x592/0xd60 fs/namei.c:2519 path_lookupat+0x138/0x660 fs/namei.c:2675 filename_lookup+0x1f3/0x560 fs/namei.c:2705 filename_setxattr+0xad/0x1c0 fs/xattr.c:660 path_setxattrat+0x1d8/0x280 fs/xattr.c:713 __do_sys_lsetxattr fs/xattr.c:754 [inline] __se_sys_lsetxattr fs/xattr.c:750 [inline] __x64_sys_lsetxattr+0xd0/0x150 fs/xattr.c:750 ... Allocated by task 9279: kasan_save_stack+0x39/0x70 mm/kasan/common.c:56 kasan_save_track+0x14/0x40 mm/kasan/common.c:77 kasan_save_alloc_info+0x37/0x60 mm/kasan/generic.c:573 poison_kmalloc_redzone mm/kasan/common.c:400 [inline] __kasan_kmalloc+0xc3/0xd0 mm/kasan/common.c:417 kasan_kmalloc include/linux/kasan.h:262 [inline] __do_kmalloc_node mm/slub.c:5650 [inline] __kmalloc_noprof+0x2bd/0x900 mm/slub.c:5662 kmalloc_noprof include/linux/slab.h:961 [inline] indx_read+0x41d/0xad0 fs/ntfs3/index.c:1059 indx_find+0x447/0x900 fs/ntfs3/index.c:1179 dir_search_u+0x2c0/0x460 fs/ntfs3/dir.c:254 ntfs_lookup+0x1cc/0x2a0 fs/ntfs3/namei.c:85 __lookup_slow+0x241/0x450 fs/namei.c:1816 lookup_slow fs/namei.c:1833 [inline] walk_component+0x31c/0x570 fs/namei.c:2151 link_path_walk+0x592/0xd60 fs/namei.c:2519 path_lookupat+0x138/0x660 fs/namei.c:2675 filename_lookup+0x1f3/0x560 fs/namei.c:2705 filename_setxattr+0xad/0x1c0 fs/xattr.c:660 path_setxattrat+0x1d8/0x280 fs/xattr.c:713 __do_sys_lsetxattr fs/xattr.c:754 [inline] __se_sys_lsetxattr fs/xattr.c:750 [inline] __x64_sys_lsetxattr+0xd0/0x150 fs/xattr.c:750 ... [CAUSE] The index-header validators only validated INDEX_HDR-level geometry. They did not walk each NTFS_DE to verify entry alignment, subnode layout, or that key_size fit inside the entry payload. They also allowed a last sentinel entry to carry a non-zero key_size. [FIX] Walk every NTFS_DE in ntfs3's index-header validators and reject entries with invalid layout, mismatched subnode state, oversized key_size, or non-zero sentinel keys before lookup or log replay can consume them.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-09-24T17:17:21.930Z",
  "pubdate": "2026-09-24T17:17:21.930Z",
  "executiveSummary": "The Linux kernel NTFS3 driver contains a heap-based out-of-bounds (OOB) memory read vulnerability within the directory index entry processing logic.\nThe vulnerability type is an Improper Input Validation issue, specifically related to the parsing of untrusted directory index data on a storage medium.\nImpact includes potential information disclosure of kernel memory contents and system instability leading to a kernel panic.\nThe vulnerability affects systems mounting malicious or corrupted NTFS filesystems.\nExploitation requires an attacker to provide a specially crafted NTFS image that can be mounted by the affected kernel.\nThis vulnerability is triggered during directory lookup operations where the kernel processes malformed index entries.\nThe risk is elevated for systems that automatically mount arbitrary external storage devices, as an attacker with physical access or the ability to provide a disk image can induce the fault.\nNo specific authentication is required to trigger the vulnerability once the malicious filesystem is mounted and accessed.",
  "technicalDetails": "The root cause of this vulnerability lies in the insufficient validation of NTFS directory index entries (NTFS_DE) within the fs/ntfs3 driver. Specifically, the driver's index-header validation routines focused exclusively on INDEX_HDR-level geometry, failing to verify the structural integrity of individual index entries.\nDuring the processing of a directory index, the kernel relies on the key_size field provided within an NTFS_DE structure. A malicious actor can craft an index entry where the advertised key_size exceeds the actual bytes present in the payload. When the directory lookup routine, specifically the cmp_fnames() function, receives this malformed entry, it attempts to read the key data based on the untrusted size field.\nBecause the driver performs no bounds checking on this key_size against the actual allocated buffer size, the kernel performs a read operation past the end of the kmalloc'ed index buffer. The KASAN (Kernel Address Sanitizer) report confirms a slab-out-of-bounds read error occurring during the execution of fname_full_size, which is invoked by cmp_fnames.\nThe attack flow proceeds as follows: 1) An attacker prepares a malicious NTFS filesystem image containing a directory index with a deliberately oversized key_size field in an NTFS_DE entry. 2) The target system mounts this filesystem. 3) An operation triggering a directory lookup (e.g., file access, xattr modification, or listing directory contents) occurs. 4) The kernel driver, performing its internal lookup (indx_find), reads the malformed metadata. 5) The cmp_fnames function attempts to access the invalid memory range, triggering a KASAN crash and potential kernel-level information leak.\nThe vulnerability also stems from a lack of validation regarding entry alignment, subnode layout, and the handling of the last sentinel entry, which is incorrectly permitted to have a non-zero key_size. This combination of structural flaws allows an attacker to manipulate the internal state of the index search, leading to memory access violations.\nWhile this is primarily an OOB read, it poses significant security risks in environments where kernel memory layout can be leaked or where the resulting crash leads to a denial-of-service condition."
}