Linux Kernel EUVD-2026-86966

Requires the ability to mount an attacker-controlled NTFS filesystem image using the Linux kernel's legacy ntfs (read-only classic) driver; the crafted boot sector must set sectors_per_cluster to 0 or another non-power-of-two value so that is_boot_sector_ntfs()'s range check passes and parse_ntfs_boot_sector() computes ffs(value)-1. Limiting factors: exploitation is local only (AV:L), needs mount privilege or an auto-mount-of-removable-media configuration (PR:L), requires the legacy CONFIG_NTFS_FS driver to be built and in use rather than the modern ntfs3 driver, and yields only a kernel crash (no code execution or data disclosure). No remote or network path exists.

This is a genuine but low-priority local denial-of-service bug, not a high-impact remote threat. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) and base score of 5.5 are internally consistent with the description: exploitation is local, requires some privilege (the ability to mount a filesystem), and yields only an availability impact (kernel crash via UBSAN shift-out-of-bounds in fs/ntfs/super.c), with no confidentiality or integrity loss. The EPSS score of 0.14% (3rd percentile) confirms very low expected exploitation activity, which aligns with the local-only attack surface. There is no CISA KEV listing (not actively exploited) and no public exploit code referenced - only upstream git commits and the NVD advisory. All signals therefore agree: real but minor. One caveat: the tag labels this a 'Buffer Overflow,' but the description and UBSAN trace describe a shift-exponent (undefined behavior) bug, not a memory-corruption overflow - the tag appears mislabeled and should not be read as implying code execution. A further nuance is PR: auto-mounting of removable media (e.g., a crafted USB NTFS image) could lower the effective privilege barrier in some desktop configurations, so PR:L is a reasonable default but worth verifying against the target's mount policy.

A local attacker (or someone with physical access supplying removable media) crafts an NTFS filesystem image whose boot sector sets sectors_per_cluster to zero or another non-power-of-two value. When the victim system mounts this image using the legacy ntfs driver, ffs(0)-1 produces a huge shift exponent and the kernel hits an undefined shift (UBSAN shift-out-of-bounds), crashing or destabilizing the system. No public exploit code was identified at time of analysis; triggering the bug is trivial given mount access but produces only denial of service.