CVE-2026-90118: ntfs: fix off-by-one page overflow in ntfs_decompress()
In the Linux kernel, the following vulnerability has been resolved:
ntfs: fix off-by-one page overflow in ntfsdecompress()
The per-token range check in ntfsdecompress() uses
if (cb >= cbsbend || dpaddr > dpsbend) break;
so dpaddr == dpsbend falls through to the symbol copy dpaddr++ = cb++, writing one byte past the destination page. Since NTFSSBSIZE == PAGESIZE the destination is a single page, so the byte lands in the adjacent page, and destofs is left one past the sub-block end (the later destofs &= ~PAGEMASK then yields 1, not 0, so the page is never finalized and later sub-blocks keep writing further past it). A corrupted compressed $DATA attribute thus produces a bounded run of out-of-bounds writes when the file is read.
Break as soon as dpaddr reaches dpsbend; a full sub-block still completes, as its final copy advances dpaddr to exactly dpsbend.
Affected Software
Event History
Frequently Asked Questions
What systems are exposed to this issue?
Systems running the Linux kernel are exposed when they read a corrupted compressed $DATA attribute on NTFS. The provided information does not identify affected kernel versions or whether a particular NTFS mount configuration is required.
What does an attacker need to exploit it?
An attacker needs a corrupted compressed NTFS $DATA attribute to be read by the vulnerable NTFS decompression path. The issue occurs during processing of the crafted file data and causes bounded out-of-bounds writes beyond the destination page.
How can I tell whether the vulnerable condition has occurred?
The described condition is triggered when decompression reaches the destination sub-block boundary and the code permits a copy with dp_addr equal to dp_sb_end. This leaves the destination offset one byte beyond the sub-block end, prevents page finalization, and allows later sub-block writes to continue past the page.
What is the relevant fix behavior?
The fix stops decompression as soon as dp_addr reaches dp_sb_end, rather than allowing a copy at that boundary. A complete sub-block remains valid because its final copy advances dp_addr to exactly dp_sb_end.