CVE-2026-90048: fs/ntfs3: fix slab-out-of-bounds write in ni_create_attr_list()
fs/ntfs3: fix slab-out-of-bounds write in nicreateattrlist()
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.157.1-1
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
Systems that loop-mount a crafted NTFS image are exposed when a file on that image is opened and an attribute is added. This can occur through an extended-attribute operation such as setxattr.
What does an attacker need to do to trigger the overflow?
The attacker needs a crafted NTFS record containing arbitrarily many equal-type, unnamed minimum-size resident attributes. The crafted image must be loop-mounted, and an operation that adds an attribute must reach the NTFS extended-attribute insertion path.
Is merely mounting or opening the NTFS image sufficient?
The described reachable path requires opening a file and adding an attribute after the crafted image is loop-mounted. The supplied data does not state that mounting alone triggers the issue.