Skip to main content

Linux Kernel CVE-2026-97438

| EUVDEUVD-2026-86051 HIGH
2026-09-24 Linux GHSA-88pg-r8xc-mrw7
Buffer Overflow Linux Red Hat Suse
7.1
CVSS 3.1 · Vendor: Linux
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Deliver malicious NTFS image via USB/disk image
  2. Delivery
    Victim mounts crafted filesystem (ntfs3)
  3. Exploit
    Path lookup walks malformed directory index
  4. Execution
    Oversized key_size read past index buffer in cmp_fnames
  5. Impact
    Kernel OOB read / KASAN panic / DoS

Vulnerability Assessment

Exploitation Conditions

Requires the ntfs3 filesystem driver to be present/enabled and the attacker to get a specially crafted, malformed NTFS image mounted on the target - typically via physical/removable media (USB), a supplied disk image, or an automounting desktop environment. The specific trigger is a directory index entry whose NTFS_DE advertises a key_size exceeding the actual payload (or a non-zero sentinel key / bad subnode layout); a directory lookup on that entry then invokes cmp_fnames and reads past the index buffer. Limiting factors: local attack vector (AV:L), mandatory user interaction to mount and access the malicious volume (UI:R), no remote reachability, and impact that is predominantly a kernel crash/DoS rather than reliable data disclosure.
Impact

This is a locally-scoped, mount-triggered out-of-bounds read in the Linux kernel ntfs3 driver, and the real-world risk is considerably lower than the headline 7.1 suggests. The provided CVSS vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H) is internally consistent with a malicious-filesystem attack: local vector, user interaction to mount/traverse the image, and no privileges. However, C:H is generous - the KASAN trace shows a single-byte read (size 1) past the end of a kmalloc'd index buffer during a name comparison (cmp_fnames/fname_full_size), which is far more likely to panic the kernel (A:H, availability/DoS) than to disclose meaningful data to an attacker, so this is crash-dominant rather than an information-disclosure primitive. No EPSS score, no CISA KEV listing, and no public POC are present in the input, so there is no signal of active or automatable exploitation - this is a syzkaller-class bug (task name syz.6.3365 in the trace) found by fuzzing, typical of a hardening fix rather than an in-the-wild threat. Net: no public exploit identified at time of analysis, patch available, and exploitation requires attacker-controlled filesystem media reaching a victim, making this a routine kernel-hardening patch to schedule with distro updates rather than an emergency.
Exploit ScenarioDerived

An attacker crafts a malformed NTFS filesystem image in which a directory index entry advertises a key_size larger than its actual NTFS_DE payload, then delivers it on removable media (USB stick) or as a disk image to a victim system with the ntfs3 driver. When the victim (or an automounter) mounts the image and any path lookup walks that directory, cmp_fnames reads past the end of the kmalloc'd index buffer, causing a KASAN-detectable slab-out-of-bounds read and likely kernel crash. No public POC is identified in the provided data; the trace originates from syzkaller fuzzing.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.1% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Sep 25, 2026

Mounting a crafted NTFS volume on a system running the Linux kernel's ntfs3 driver can drive a slab out-of-bounds read: a malformed directory index entry declares a key_size larger than the bytes actually present in its NTFS_DE payload, and the subsequent directory lookup passes that key to cmp_fnames(), which reads past the end of the kmalloc'ed index buffer. The flaw is local (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H, 7.1) and requires the victim to mount and access the malicious image, typically via removable media, a supplied disk image, or a desktop automount path; the practical consequence is most often a kernel crash or denial of service rather than reliable disclosure of meaningful data, so real-world risk is lower than the headline score implies. No public exploit code or confirmed active exploitation was identified at time of analysis, and vendor-released fixes exist in Linux 6.18.53, 6.12.111, and 7.2.

RemediationAI

Apply the vendor-released patch by upgrading to Linux 6.18.53 or 6.12.111 in the corresponding stable branch, or to 7.2 (or later) on mainline; the upstream stable commits are https://git.kernel.org/stable/c/a8f4fb6a7d58974ffc9aed597401528b181d76dc, https://git.kernel.org/stable/c/0257e3ea00e19129f3ad5c039d8b8fdff0796835, and https://git.kernel.org/stable/c/98d6e5d9dc1d34dcffc61549617581a5fe1ef807, and distributions should be checked for their own backported kernel build before assuming they are fixed. Where immediate upgrade is not possible, the most effective compensating control is to stop untrusted NTFS volumes from reaching the kernel driver: unload or blacklist the ntfs3 module (modprobe -r ntfs3; echo 'blacklist ntfs3' > /etc/modprobe.d/blacklist-ntfs3.conf) so the malformed image is never parsed in kernel context, at the cost of losing native NTFS read/write support and breaking any mounts that rely on it. As a fallback, route NTFS access through the userspace ntfs-3g/FUSE driver, which confines any out-of-bounds read to an unprivileged userspace process instead of the kernel, though it is slower and does not support every ntfs3 feature. Organizations can also disable desktop automounting of removable media (for example via udev/udisks2 policy) and require explicit, trusted-only mounting of external disks and disk images, which removes the typical UI:R delivery path but degrades user convenience. There is no vendor workaround beyond patching and access control - do not attempt to 'sanitize' malicious images, since the vulnerable parse occurs during lookup on the mounted filesystem.

Affected VersionsENISA

Linux patch: 7.2
Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <98d6e5d9dc1d34dcffc61549617581a5fe1ef807
Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <a8f4fb6a7d58974ffc9aed597401528b181d76dc
Linux patch: 6.18.53
Linux 0 <6.18.53
Linux patch: 6.12.111
Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <0257e3ea00e19129f3ad5c039d8b8fdff0796835
Linux 0 <6.12.111

Affected Packages

euvd linux fix: 6.12.111, 6.18.53

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

ntfs3 is the in-kernel NTFS read/write driver (fs/ntfs3), reached here through the directory index machinery: indx_read() allocates the index buffer with kmalloc, hdr_find_e() walks entries, indx_find()/dir_search_u()/ntfs_lookup() resolve a name, and cmp_fnames() compares the on-disk key via fname_full_size(). The root cause is an incomplete validation boundary in the index-header validators: they checked only INDEX_HDR-level geometry (buffer size and header structure) and never walked each individual NTFS_DE entry to confirm entry alignment, subnode layout/state, or that key_size fit within the actual entry payload, and they also permitted a terminal sentinel entry to carry a non-zero key_size. The KASAN report (slab-out-of-bounds in fname_full_size, inlined at cmp_fnames+0x1ea) shows a 1-byte read immediately past the allocated index buffer, which is the classic CWE-125 out-of-bounds read pattern. Because the parse happens on the lookup path, the crash/read is triggered simply by resolving a filename inside a mounted malicious volume. Affected CPE: cpe:2.3:a:linux:linux with the ntfs3 driver enabled; EUVD tracks this as EUVD-2026-86051.

Know when the next one hits your stack

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (Linux) PRIMARY 7.1 HIGH
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H
vuln.today AI 6.1 MEDIUM

Local mount of attacker-crafted NTFS media (AV:L, UI:R, PR:N); single-byte OOB read is crash-dominant so A:H with only marginal C:L and no integrity impact.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H
4.0 AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE 5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Red Hat 5.5 MEDIUM

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
High

Lifecycle Timeline

4
CVSS changed
Sep 25, 2026 - 05:23 NVD
7.1 (HIGH)
Patch available
Sep 24, 2026 - 17:03 EUVD
CVE Published
Sep 24, 2026 - 16:03 cve.org
HIGH 7.1
CVE Published
Sep 24, 2026 - 16:03 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

fs/ntfs3: validate index entry key bounds

[BUG] A malformed NTFS directory index entry can advertise a key_size larger than the bytes actually present in its NTFS_DE payload. Directory lookup then passes that malformed key to cmp_fnames(), which can read past the end of the kmalloc'ed index buffer.

BUG: KASAN: slab-out-of-bounds in fname_full_size fs/ntfs3/ntfs.h:590 [inline] BUG: KASAN: slab-out-of-bounds in cmp_fnames+0x1ea/0x230 fs/ntfs3/index.c:46 Read of size 1 at addr ffff88801c313018 by task syz.6.3365/9279

Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0xbe/0x130 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0xd1/0x650 mm/kasan/report.c:482 kasan_report+0xfb/0x140 mm/kasan/report.c:595 __asan_report_load1_noabort+0x14/0x30 mm/kasan/report_generic.c:378 fname_full_size fs/ntfs3/ntfs.h:590 [inline] cmp_fnames+0x1ea/0x230 fs/ntfs3/index.c:46 hdr_find_e.isra.0+0x3ed/0x670 fs/ntfs3/index.c:762 indx_find+0x4b5/0x900 fs/ntfs3/index.c:1186 dir_search_u+0x2c0/0x460 fs/ntfs3/dir.c:254 ntfs_lookup+0x1cc/0x2a0 fs/ntfs3/namei.c:85 __lookup_slow+0x241/0x450 fs/namei.c:1816 lookup_slow fs/namei.c:1833 [inline] walk_component+0x31c/0x570 fs/namei.c:2151 link_path_walk+0x592/0xd60 fs/namei.c:2519 path_lookupat+0x138/0x660 fs/namei.c:2675 filename_lookup+0x1f3/0x560 fs/namei.c:2705 filename_setxattr+0xad/0x1c0 fs/xattr.c:660 path_setxattrat+0x1d8/0x280 fs/xattr.c:713 __do_sys_lsetxattr fs/xattr.c:754 [inline] __se_sys_lsetxattr fs/xattr.c:750 [inline] __x64_sys_lsetxattr+0xd0/0x150 fs/xattr.c:750 ...

Allocated by task 9279: kasan_save_stack+0x39/0x70 mm/kasan/common.c:56 kasan_save_track+0x14/0x40 mm/kasan/common.c:77 kasan_save_alloc_info+0x37/0x60 mm/kasan/generic.c:573 poison_kmalloc_redzone mm/kasan/common.c:400 [inline] __kasan_kmalloc+0xc3/0xd0 mm/kasan/common.c:417 kasan_kmalloc include/linux/kasan.h:262 [inline] __do_kmalloc_node mm/slub.c:5650 [inline] __kmalloc_noprof+0x2bd/0x900 mm/slub.c:5662 kmalloc_noprof include/linux/slab.h:961 [inline] indx_read+0x41d/0xad0 fs/ntfs3/index.c:1059 indx_find+0x447/0x900 fs/ntfs3/index.c:1179 dir_search_u+0x2c0/0x460 fs/ntfs3/dir.c:254 ntfs_lookup+0x1cc/0x2a0 fs/ntfs3/namei.c:85 __lookup_slow+0x241/0x450 fs/namei.c:1816 lookup_slow fs/namei.c:1833 [inline] walk_component+0x31c/0x570 fs/namei.c:2151 link_path_walk+0x592/0xd60 fs/namei.c:2519 path_lookupat+0x138/0x660 fs/namei.c:2675 filename_lookup+0x1f3/0x560 fs/namei.c:2705 filename_setxattr+0xad/0x1c0 fs/xattr.c:660 path_setxattrat+0x1d8/0x280 fs/xattr.c:713 __do_sys_lsetxattr fs/xattr.c:754 [inline] __se_sys_lsetxattr fs/xattr.c:750 [inline] __x64_sys_lsetxattr+0xd0/0x150 fs/xattr.c:750 ...

[CAUSE] The index-header validators only validated INDEX_HDR-level geometry. They did not walk each NTFS_DE to verify entry alignment, subnode layout, or that key_size fit inside the entry payload. They also allowed a last sentinel entry to carry a non-zero key_size.

[FIX] Walk every NTFS_DE in ntfs3's index-header validators and reject entries with invalid layout, mismatched subnode state, oversized key_size, or non-zero sentinel keys before lookup or log replay can consume them.

Executive ViewAI

Why It Matters

The Linux kernel's ntfs3 driver contains a high-severity vulnerability that can crash affected systems when a user mounts a specially crafted NTFS volume from removable media, a supplied disk image, or an automount path. Because exploitation requires local user interaction and primarily causes denial of service rather than data theft, the immediate business concern is availability of Linux endpoints and servers that handle untrusted NTFS media. No public exploit identified at time of analysis, and vendor fixes are available.

Business Impact: Medium
Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score
0.1%
Top 98% exploitable
Prevalence
High
ntfs3 ships in mainline Linux kernel; widely present though mount-gated in use
Data Quality
4 sources
Confidence: Medium
EUVD NVD CVE.org EPSS MSRC Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.1%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Defer
Exploitation· derived
None
System Exposure· derived
Small
Automatable· derived
No
Human Impact
Medium

Priority Score

36
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +36
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-97438 ADVISORY https://vuldb.com/vuln/409598 REF https://git.kernel.org/stable/c/0257e3ea00e19129f3ad5c039d8b8fdff0796835 REF https://git.kernel.org/stable/c/7feeb424bda7f6ffaf5090cdd01b300eaa74c02b REF https://git.kernel.org/stable/c/98d6e5d9dc1d34dcffc61549617581a5fe1ef807 REF https://git.kernel.org/stable/c/a8f4fb6a7d58974ffc9aed597401528b181d76dc REF https://git.kernel.org/stable/c/c8d93bc4823baecab3c39b877e16ac5f8d4d41ba REF https://git.kernel.org/stable/c/d564a885219a655077eefafeb72395a4580ebd69

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy