Cloudanix VulnDB

CVE-2026-98136

High · 7.1

CVSS

7.1

EPSS

0.1%

Published

Sep 25, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A flaw in how Linux reads certain data from NTFS disks can let a carefully made disk cause the computer to crash or reveal internal memory when someone tries to create a file.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Low
Impact
Data Exposure
Component
OS kernel
Class
Memory Corruption
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Out-of-bounds read in ntfs_attr_find_in_attrdef() caused by a loop guard that checks only the start offset of each attr_def entry against attrdef_size instead of ensuring the entire 160-byte entry fits; a volume with $AttrDef smaller than one entry allows reads past the kvzalloc allocation when file creation reaches ntfs_attr_size_bounds_check.

Why it matters to the business

Linux systems mounting NTFS volumes can experience kernel crashes or limited information disclosure during routine file operations, increasing operational risk on any host that accepts untrusted NTFS media.

How an attack unfolds

An attacker prepares an NTFS volume whose on-disk $AttrDef data is smaller than 160 bytes, mounts it on a vulnerable kernel, and triggers file creation; the call chain ntfs_attr_add → ntfs_attr_can_be_non_resident → ntfs_attr_size_bounds_check → ntfs_attr_find_in_attrdef performs the out-of-bounds read of ad->type.

How to fix it

Apply the upstream fix that changes the loop condition to require the full attr_def entry inside attrdef_size and rejects mount when $AttrDef is smaller than one entry; upgrade to a kernel containing the corrected load_and_init_attrdef and ntfs_attr_find_in_attrdef logic.

How to confirm the fix worked

Confirm the patch by inspecting the loop guard in ntfs_attr_find_in_attrdef for an explicit check that (u8 *)ad + sizeof(struct attr_def) <= (u8 *)vol->attrdef + vol->attrdef_size, and verify that mount fails on volumes whose $AttrDef is smaller than 160 bytes.

Typical attack path

  1. attacker crafts NTFS volume with undersized $AttrDef table
  2. victim mounts the volume on an unpatched kernel
  3. attacker or automated process creates a file on the mounted volume
  4. ntfs_attr_add invokes the vulnerable attribute-size check
  5. kernel performs slab-out-of-bounds read and may crash or leak data

How to detect it

Search kernel logs for KASAN slab-out-of-bounds reports listing ntfs_attr_find_in_attrdef, ntfs_attr_size_bounds_check, or ntfs_attr_add; correlate with recent NTFS mount and file-creation events.

What your security team should do

  • Prioritize kernel updates on any system that mounts NTFS volumes from untrusted sources
  • Add NTFS mount restrictions or read-only policies until patches are deployed
  • Monitor for KASAN or BUG reports containing ntfs_attr_find_in_attrdef after NTFS mount activity

The record

In the Linux kernel, the following vulnerability has been resolved: ntfs: bound $AttrDef table walk to the loaded table size ntfs_attr_find_in_attrdef() walks the in-memory $AttrDef table, but the loop condition bounds only the start of each entry, not the whole entry: for (ad = vol->attrdef; (u8 *)ad - (u8 *)vol->attrdef < vol->attrdef_size && ad->type; ++ad) struct attr_def is 160 bytes; the guard reads ad->type at offset 128 and the loop body reads further fields. vol->attrdef is kvzalloc(i_size), where i_size is the on-disk $AttrDef data size, checked in load_and_init_attrdef() only as 0 < i_size <= 0x7fffffff. A volume whose $AttrDef data size is smaller than one entry (e.g. 120 bytes) makes the read of ad->type run past the allocation. Creating a file reaches this through ntfs_attr_size_bounds_check() and reads out of bounds: BUG: KASAN: slab-out-of-bounds in ntfs_attr_find_in_attrdef+0x66/0xa0 Read of size 4 at addr ffff888005833280 by task init/1 ntfs_attr_find_in_attrdef ntfs_attr_size_bounds_check ntfs_attr_can_be_non_resident ntfs_attr_add Require the whole entry to lie within attrdef_size in the loop guard, and reject at mount a $AttrDef too small to hold one attr_def entry.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities