Cloudanix VulnDB

CVE-2026-98135

Medium · 5.5

CVSS

5.5

EPSS

0.1%

Published

Sep 25, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

Linux can crash when it tries to read a specially formatted disk image that contains invalid layout information.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Low
Impact
Denial Of Service
Component
OS kernel
Class
Improper Input Validation
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Insufficient validation in is_boot_sector_ntfs() accepts non-power-of-two sectors_per_cluster values (including zero); these reach parse_ntfs_boot_sector() where ffs(0)-1 produces an out-of-bounds shift exponent, triggering UBSAN shift-out-of-bounds in fs/ntfs/super.c.

Why it matters to the business

Mounting a crafted NTFS image on an unpatched kernel can crash the system, causing denial-of-service and interrupting workloads that rely on local or removable storage.

How an attack unfolds

An attacker creates an NTFS filesystem image containing a boot sector with an invalid sectors_per_cluster value, then causes the target kernel to mount that image; the flawed parsing path executes the undefined shift and destabilizes the kernel.

How to fix it

Apply the upstream patch that strengthens is_boot_sector_ntfs() to reject any non-power-of-two sectors_per_cluster value; rebuild and deploy the fixed kernel across affected systems.

How to confirm the fix worked

Confirm the patched kernel rejects boot sectors with sectors_per_cluster values that are zero or not exact powers of two; re-test mount attempts with crafted images and verify absence of UBSAN reports.

Typical attack path

  1. Prepare NTFS image with non-power-of-two sectors_per_cluster in boot sector
  2. Present image via loopback, USB, or network share
  3. Trigger mount operation on vulnerable kernel
  4. Observe kernel crash or UBSAN report

How to detect it

Search kernel logs and dmesg for UBSAN shift-out-of-bounds messages referencing fs/ntfs/super.c and sectors_per_cluster; correlate with recent mount attempts of external or loopback NTFS volumes.

  • UBSAN: shift-out-of-bounds in fs/ntfs/super.c
  • shift exponent 4294967295 is too large for 32-bit type

What your security team should do

  • Expedite kernel updates for any system that may mount untrusted NTFS volumes
  • Add kernel log monitoring for NTFS-related shift or UBSAN errors
  • Restrict NTFS mount privileges where possible until patches are deployed

The record

In the Linux kernel, the following vulnerability has been resolved: ntfs: reject invalid sectors_per_cluster in the boot sector is_boot_sector_ntfs() checks the boot sector's sectors_per_cluster field with a range test that rejects 0x81..0xf3 but accepts 0 and other non-power-of-two counts. A zero value reaches parse_ntfs_boot_sector(): sectors_per_cluster_bits = ffs(sectors_per_cluster) - 1; ... vol->cluster_size = vol->sector_size << sectors_per_cluster_bits; ffs(0) is 0, so sectors_per_cluster_bits becomes (unsigned)-1 and the shift is undefined: UBSAN: shift-out-of-bounds in fs/ntfs/super.c:673:39 shift exponent 4294967295 is too large for 32-bit type 'int' This change rejects any non-power-of-two value, since it feeds the aforementioned shift via ffs() - 1, which only yields the correct shift for a power of two.

Affected packages

Ecosystem Package Introduced Fixed