CVE-2026-90048

A flaw was found in the Linux kernel's fs/ntfs3 module. The nicreateattrlist function, responsible for creating attribute lists for NTFS file system records, allocates a fixed-size buffer. However, it fails to validate the size of the attribute list against the allocated buffer, allowing a crafte...

CVE-2026-89782

A flaw was found in the Linux kernel's NTFS3 file system driver. A local attacker can exploit this vulnerability by mounting a specially crafted NTFS image. During the processing of the $LogFile, an integer truncation error occurs when attempting to grow the restart table, leading to an...

CVE-2026-89781

A flaw was found in the Linux kernel's NTFS3 file system driver. A local user could exploit this vulnerability by mounting a specially crafted NTFS image. This could lead to an out-of-bounds read, allowing the disclosure of sensitive information from adjacent memory areas...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: reject restart table growth beyond U16MAX entries During $LogFile replay, logreplay indexes the transaction table by the transactid taken from the log record header. checklogrec only verifies that transactid is non-zero...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: bound attroff in UpdateResidentValue against dataoff In the UpdateResidentValue case within doaction fslog.c:3307, lrh-attroff and lrh-redolen come from the on-disk LRH. When they satisfy aoff + dlen res.dataoff, the...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: bound copylcns dp-pagelcns index in analysis pass In logreplay’s analysis pass, after finddp returns a valid DIRPAGEENTRY for the targetattr, targetvcn tuple, the copylcns block walks lrh-lcnsfollow further entries: t16...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: add depth limit to indxfindbuffer to prevent stack overflow indxfindbuffer recursively descends the B+ tree index without any depth limit. A specially crafted NTFS image containing circular index node references leads t...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: validate Dirty Page Table capacity in logreplay copylcns During the analysis phase of $LogFile journal replay, logreplay copies LCNs from each action log record into an existing Dirty Page Table DPT entry without boundi...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: validate lcnsfollow in logreplay conversion logreplay converts DIRPAGEENTRY32 records into DIRPAGE-entry records when replaying version 0 restart tables. During this conversion, the memmove length is derived directly fr...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: fix info-leak on partial LZNT decompress in nireadframe nireadframe decompresses an LZNT $DATA frame into the vmapped target pages and then trusts the return value from decompresslznt: uncsize = decompresslzntframeondis...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: validate dirty page table on log replay Each DIRPAGE-entry ends in a pagelcns array whose length is determined by the on-disk lcnfollow field. checkrstbl validates the table’s bookkeeping mechanism; however, it never...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: ntfs3: bound tomove in indxinsertintoroot before hdrinserthead indxinsertintoroot promotes a full resident $INDEXROOT into $INDEXALLOCATION and copies all non-last resident root entries into a newly allocated INDEXBUFFER via...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: bound NTFSDE view.dataoff in UpdateRecordDataRoot,Allocation In the UpdateRecordDataRoot fslog.c:3489 and UpdateRecordDataAllocation fslog.c:3697 cases within doaction, the destination of memmove is Add2Ptre,...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: ntfs3: cap RESTARTTABLE free-chain walker at rt-used A crafted NTFS3 disk image triggers an in-kernel infinite loop at mount time, hanging the mounting thread and firing the soft-lockup watchdog within 22 seconds on multi-CPU hos...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: fix out-of-bounds read of INDEXROOT in reparse/objid init ntfsreparseinit and ntfsobjidinit parse the index root of the $Extend/$Reparse and $Extend/$ObjId metafiles the INDEXROOT attributes named $R and $O. They read i...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: add bounds check to rungethighestvcn rungethighestvcn parses a packed NTFS mapping-pairs buffer without any length bound, relying solely on a 0x00 terminator to stop. A crafted $LogFile UpdateMappingPairs record whose...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: bound pagelcns index by the log record The copylcns loop and the redo shorten loop index pagelcns at j + i, where i runs up to the log record’s lcnsfollow. This count is checked only against the record’s own length, not...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: bound DeleteIndexEntryAllocation memmove length In the DeleteIndexEntryAllocation case within doaction, e-size comes from an on-disk INDEXBUFFER entry. When e-size causes e + e-size to exceed hdr + hdr-used, PtrOffsete1...

CVE-2026-99171

A flaw was found in the Linux kernel's NTFS3 file system driver. When an NTFS file system is mounted with case-insensitive naming, internal file system structures can be released prematurely while a lookup operation is still active. A local attacker can exploit this race condition to cause a...

CVE-2026-99171

In the Linux kernel, the following vulnerability has been resolved: ntfs3: free the sbi after a grace period If the "nocase" mount option ntfs3 uses custom hash and dentry compare functions. Both access ntfs3 superblock private information in rcu pathwalk. ntfsputsuper and ntfs3killsb drop the in...