CVE-2026-90048
CriticalCVSS 9.8Exploitation Probability (EPSS)
Elevated risk52th percentile - higher than 52% of all known CVEs
Summary
In the Linux kernel, ni_create_attr_list() in the ntfs3 filesystem has a slab-out-of-bounds write. The function allocates a fixed buffer of record_size bytes and writes one ATTR_LIST_ENTRY per attribute without checking the buffer end. A crafted NTFS image with many minimum-size nameless attributes can overflow the heap buffer.
Risk Assessment
This vulnerability can cause kernel memory corruption, system crash (panic), or potentially arbitrary code execution with kernel privileges. It requires mounting a crafted NTFS image and performing an operation such as setxattr, which is feasible in environments handling untrusted disk images.
Recommendation
Update the Linux kernel to a version containing the fix for CVE-2026-90048. Avoid mounting untrusted NTFS images until the update is applied.
Other vulnerabilities in Linux kernel (ntfs3)
See all- CVE-2026-99171Low risk· EPSS 7%
A use-after-free vulnerability exists in the Linux kernel's ntfs3 module. When the "nocase" mount option is used, dentry compare and hash functions access superblock private data in the RCU pathwalk, while ntfs_put_super() and ntfs3_kill_sb() free that data without an RCU delay. A lookup still inside the filesystem when the last mount reference is dropped causes a UAF.
- CVE-2026-98539Low risk· EPSS 10%
In the Linux kernel's ntfs3 filesystem, ntfs_create_inode() called d_instantiate() before unlock_new_inode(), causing a race between directory creation and mounting a filesystem on the same path. This reset the i_rwsem lock state (count and owner) while another thread already held it, triggering warnings in do_new_mount and potentially causing inode_lock() to hang indefinitely. The fix switches to d_instantiate_new() and removes the trailing unlock_new_inode().
- CVE-2025-37806Medium
In the Linux kernel, the ntfs3 filesystem lacks synchronization between write operations and ioctl calls that clear the file's compression flag. If a user clears the compression flag during a write, the kernel selects incorrect operations and triggers a NULL pointer dereference, causing a kernel oops.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: fix slab-out-of-bounds write in ni_create_attr_list() ni_create_attr_list() allocates a fixed buffer of al_aligned(record_size) (== record_size) bytes and then walks every attribute of the primary MFT record, writing one ATTR_LIST_ENTRY per attribute and advancing the cursor by le_size(name_len), with no check against the end of the buffer; the total size is only computed after the loop. A minimum-size resident attribute occupies SIZEOF_RESIDENT (0x18 = 24) bytes on disk, but an unnamed attribute expands to le_size(0) (0x20 = 32) bytes in the list. Because the number of attributes in a record is not bounded (mi_enum_attr() accepts arbitrarily many equal-type, nameless minimum-size attributes), a crafted record packed with such attributes produces a list larger than record_size and overflows the heap buffer. This is reachable from a crafted, loop-mounted NTFS image: opening the file and adding an attribute (e.g. via setxattr) drives ntfs_set_ea() -> ni_insert_resident() -> ni_insert_attr() -> ni_ins_attr_ext() -> ni_create_attr_list(). BUG: KASAN: slab-out-of-bounds in ni_create_attr_list+0xc48/0x1058 Write of size 4 at addr ffff000008984c00 by task setfattr/345 ni_create_attr_list+0xc48/0x1058 ni_ins_attr_ext+0x510/0x7c0 ni_insert_attr+0x3f8/0x70c ni_insert_resident+0xc8/0x3b0 ntfs_set_ea+0x66c/0xd28 ntfs_setxattr+0x4d8/0x5b0 __arm64_sys_setxattr+0xa4/0x124 Allocated by task 345: ni_create_attr_list+0x188/0x1058 The buggy address belongs to the cache kmalloc-1k of size 1024 (the write lands at object+1024). Size the buffer from the actual attributes instead of assuming a single record_size is always enough.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS