Linux Kernel EUVD-2026-76523

Requires the ntfs3 driver to be present and used to mount an attacker-controlled NTFS filesystem image; the malicious MFT record must set name_offset so a named non-sparse/non-compressed attribute lies at the attribute end or overlaps mapping pairs, and the code path triggers when that attribute is converted to sparse (needing the missing 8 bytes for compressed_size). Limiting factors: exploitation is local (mount operation, not network) and normally needs mount capability (CAP_SYS_ADMIN) or an automount configuration that mounts removable media automatically; it does not affect systems without ntfs3 in use.

The published CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, 9.8) is inconsistent with the described mechanism: the bug requires mounting a crafted NTFS filesystem image, which is a local, not network, operation and typically requires either privilege (CAP_SYS_ADMIN) or automount of attacker-supplied removable media - so the realistic vector is AV:L with PR:L, not AV:N/PR:N. Corroborating signals point to modest real-world risk: EPSS is 0.15% (5th percentile), there is no CISA KEV listing, and no public proof-of-concept has been identified. Technical impact is a controlled/bounded OOB write in kernel context, which is serious (potential privilege escalation or panic) but gated behind local filesystem access. Net: patch on a normal cadence rather than treating the 9.8 as an emergency; the score is inflated by an incorrect attack vector.

An attacker crafts a malicious NTFS image whose MFT attribute record sets name_offset so the name sits at the attribute's end (or overlaps the mapping pairs). When the volume is mounted and the driver converts the attribute to sparse, ntfs_attr_update_meta() shifts the name eight bytes forward and writes past the attribute boundary, corrupting adjacent kernel memory. Delivery is via attacker-supplied removable media or an image the victim mounts; no public PoC is known and exploitation requires local access.