CVE-2026-89611: ntfs: validate non-resident attribute offsets
In the Linux kernel, the following vulnerability has been resolved:
ntfs: validate non-resident attribute offsets
ntfsattrupdatemeta() shifts the attribute name when converting between non-sparse and sparse attributes. Converting to sparse also adds the compressedsize field before the name and mapping pairs, requiring eight additional bytes in the attribute record.
However, the validator does not check that nameoffset is within safe boundaries for these operations or that the additional space is available. A malicious MFT record could set nameoffset such that:
1. The name is positioned at the very end of a non-sparse attribute. Converting to sparse would shift the name forward by 8 bytes, writing beyond the attribute boundary.
2. The name overlaps with the mapping pairs, causing corruption during conversion.
Add validation to ensure: - For named attributes, nameoffset is within valid bounds - Name does not extend beyond the attribute or overlap with mapping pairs - For non-sparse, non-compressed attributes, eight bytes are available after mappingpairsoffset for the compressedsize field
The space check also covers unnamed attributes, for which nameoffset = 0 is valid and no name range needs to be checked.
Affected Software
Event History
Frequently Asked Questions
What must an attacker control to trigger this issue?
An attacker needs to supply a malicious NTFS Master File Table (MFT) record with crafted non-resident attribute offsets. The record can place an attribute name at the end of the attribute or make it overlap the mapping pairs.
When does the unsafe write occur?
The issue is triggered when ntfs_attr_update_meta() converts a non-sparse attribute to a sparse attribute. That conversion inserts an eight-byte compressed_size field and shifts the attribute name and mapping pairs.
What validation does the fix add?
The fix verifies that named attribute name_offset values are within valid bounds, that names do not extend beyond the attribute or overlap mapping pairs, and that sufficient space exists for the compressed_size field. The space check also applies to unnamed attributes, where name_offset of zero is valid.