CVE-2026-90200: fs/ntfs3: fix integer overflow in MFT cluster validation
In the Linux kernel, the following vulnerability has been resolved:
fs/ntfs3: fix integer overflow in MFT cluster validation
In ntfsinitfromboot(), the boot sector's MFT cluster numbers are validated against the volume size with:
if (mlcn sctperclst >= sectors || mlcn2 sctperclst >= sectors) goto out;
mlcn and mlcn2 are u64 fields read directly from the boot sector. sctperclst is bounded above by 4096 (truesectorsperclst() plus the ispowerof2() check below it), but the multiplication is done in u64 and wraps when mlcn (or mlcn2) is large enough -- e.g. mlcn near 2^62 with sctperclst == 4 wraps to 0, which compares below any non-zero 'sectors', so the check is bypassed and the malformed record is accepted.
The accepted mlcn is then used unchanged in
sbi->mft.lbo = mlcn << clusterbits;
In practice the resulting reads fail at the block layer (sbbread() returns NULL via growbuffers()'s checkmuloverflow() guard), so today this manifests as mount failing in odd places rather than as something more dangerous, but the validation step is still wrong and there is no reason for callers to rely on the block layer to catch a value that should never have been accepted in the first place.
Use checkmuloverflow() to compute the two sector positions and fail the mount if either multiplication wraps; this preserves the existing semantics (mlcn sctperclst >= sectors) instead of switching to division (mlcn >= sectors / sctperclst), which would tighten the check at edge cases where 'sectors' is not a multiple of sctperclst. The checkoverflow() style is the one ntfs3 already uses for similar on-disk arithmetic in fs/ntfs3/run.c.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.111-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 7.2.6-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.111-1~deb12u1 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.1.191 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.6.157 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.12.110 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.18.52 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 7.2.6 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.113-1~deb12u1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
In fs/ntfs3 ntfs_init_from_boot(), use check_mul_overflow() to compute mlcn * sct_per_clst and mlcn2 * sct_per_clst, and fail the mount if either multiplication wraps before comparing the resulting sector positions with sectors.
Event History
Frequently Asked Questions
What systems are exposed to this issue?
Systems that mount an NTFS volume using the Linux kernel's ntfs3 filesystem driver are exposed to malformed boot-sector MFT cluster values. The affected values are read directly from the mounted volume's boot sector.
What does an attacker need to trigger the flawed validation?
An attacker needs to provide an NTFS volume with an excessively large MFT cluster number or MFT mirror cluster number such that multiplication by sectors per cluster wraps in u64 arithmetic. This can cause the volume's malformed metadata to pass the initial volume-size validation.
What is the observed impact described for malformed volumes?
The resulting MFT location is used unchanged, but reads currently fail at the block layer because of an overflow guard. In practice, the reported behavior is a mount failure in an unexpected location rather than a more dangerous outcome.
How can an administrator recognize a possible encounter with this issue?
The provided information indicates that mounting a specially malformed NTFS volume may fail, with the failure occurring after the incorrect MFT cluster validation has accepted the value. It does not provide a specific log message or other definitive detection indicator.