EUVD-2026-67549
GHSA-hmfm-f852-mmj6
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Local trigger via a mounted crafted NTFS volume (AV:L, PR:L to mount); OOB read yields limited memory disclosure (C:L) and kernel crash (A:H) with no integrity impact.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
ntfs: bound the look-ahead attribute-list entry in ntfs_external_attr_find()
When resolving an attribute lookup with a non-zero @lowest_vcn, ntfs_external_attr_find() peeks at the next $ATTRIBUTE_LIST entry to decide whether to keep searching, but bounds that not-yet-validated entry only with "(u8 *)next_al_entry + 6 < al_end" (which proves just bytes 0..6 are in range) and "(u8 *)next_al_entry + length <= al_end" with an attacker-controlled, non-8-aligned length. It then reads next_al_entry->lowest_vcn (an __le64 at offset 8) and the name at next_al_entry->name_offset, both of which can lie past al_end -- the exact end of the kvmalloc'd attribute-list buffer (allocated at the on-disk attr_list_size, no rounding). A crafted on-disk $ATTRIBUTE_LIST whose last entry sits a few bytes before al_end therefore yields a slab out-of-bounds read when the inode is read.
Validate the look-ahead entry with ntfs_attr_list_entry_is_valid() (added in patch 1/3) before dereferencing lowest_vcn and the name, so the same fixed-header, length and name bounds the main attribute-list walk uses now guard this read too.
AnalysisAI
Out-of-bounds slab read in the Linux kernel's legacy in-kernel NTFS driver lets a crafted on-disk $ATTRIBUTE_LIST leak or crash adjacent kernel heap memory when a malicious NTFS volume is mounted and read. The flaw is in ntfs_external_attr_find(), where a look-ahead attribute-list entry is dereferenced past the end of the kvmalloc'd buffer. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to supply a crafted on-disk NTFS $ATTRIBUTE_LIST (a maliciously formatted volume/image) that is then mounted and read by the in-kernel NTFS driver, with the trigger being an attribute lookup carrying a non-zero lowest_vcn whose last attribute-list entry is positioned a few bytes before the end of the kvmalloc'd buffer. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The supplied CVSS 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H) is inconsistent with the described mechanism and should be treated as automated over-scoring - verify with vendor. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: upgrade to Linux kernel 7.2 or the 7.1.5 stable release (or a distribution kernel that backports commits 44885c9b45eb and 344b18f389f9), which validate the look-ahead attribute-list entry with ntfs_attr_list_entry_is_valid() before dereferencing lowest_vcn and the name; see https://git.kernel.org/stable/c/44885c9b45eb4082fb7f558590d84bb254a08e94 and https://git.kernel.org/stable/c/344b18f389f9934d59c7b0cf3d20541ea2e0da58. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory Linux systems supporting NTFS and assess exposure to external or untrusted NTFS volumes. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today