CVE-2026-90133: ntfs: Fix index_root heap OOB write in ntfs_ir_to_ib()

In the Linux kernel, the following vulnerability has been resolved:

ntfs: Fix indexroot heap OOB write in ntfsirtoib()

ntfsirtoib copies all entries from indexroot into a freshly allocated indexblocksize-byte buffer without verifying that the entries fit in the available space. The entries in indexroot may be larger than the usable entry space in the index block.

This can cause OOB writes past the end of the allocation.

The validator ntfsindexrootinconsistent() checks that entries are self-consistent within the IR value, but never cross-checks them against indexblocksize. There is no bounds check in ntfsirtoib() before the memcpy.

Fixing this at the sink in ntfsirtoib() since ntfsindexrootinconsistent() validates the logical consistency of indexroot as a structure and a root with large entries is a structurally valid root. The bug is a size conflict of ntfsirtoib(). Also, the validator is called once per inode load in ntfsreadlockedinode() while ntfsirtoib() is only called during a reparent, a check there adds no overhead to the common path. Moreover, even a future call path that bypasses the validator would still be protected.

With NULL as first parameter of ntfserror(), the volume error flag is never set by this call, so the device name will be absent from the error message. In any case, that the caller, ntfsirreparent(), prints an error message that includes the device name on NULL returns. I think this is the best solution available without adding 'struct superblock sb' as a parameter to ntfsirtoib().

This heap out-of-bounds write is triggered by a crafted filesystem image, which is not in the kernel threat model, anyway, fixing memory errors would be nice to keep things secure.