CVE-2026-90200: fs/ntfs3: fix integer overflow in MFT cluster validation
In the Linux kernel, the following vulnerability has been resolved:
fs/ntfs3: fix integer overflow in MFT cluster validation
In ntfsinitfromboot(), the boot sector's MFT cluster numbers are validated against the volume size with:
if (mlcn sctperclst >= sectors || mlcn2 sctperclst >= sectors) goto out;
mlcn and mlcn2 are u64 fields read directly from the boot sector. sctperclst is bounded above by 4096 (truesectorsperclst() plus the ispowerof2() check below it), but the multiplication is done in u64 and wraps when mlcn (or mlcn2) is large enough -- e.g. mlcn near 2^62 with sctperclst == 4 wraps to 0, which compares below any non-zero 'sectors', so the check is bypassed and the malformed record is accepted.
The accepted mlcn is then used unchanged in
sbi->mft.lbo = mlcn << clusterbits;
In practice the resulting reads fail at the block layer (sbbread() returns NULL via growbuffers()'s checkmuloverflow() guard), so today this manifests as mount failing in odd places rather than as something more dangerous, but the validation step is still wrong and there is no reason for callers to rely on the block layer to catch a value that should never have been accepted in the first place.
Use checkmuloverflow() to compute the two sector positions and fail the mount if either multiplication wraps; this preserves the existing semantics (mlcn sctperclst >= sectors) instead of switching to division (mlcn >= sectors / sctperclst), which would tighten the check at edge cases where 'sectors' is not a multiple of sctperclst. The checkoverflow() style is the one ntfs3 already uses for similar on-disk arithmetic in fs/ntfs3/run.c.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Update ntfs3 MFT cluster validation to compute the two sector positions using check_mul_overflow() (instead of unchecked multiplication) and reject malformed boot-sector mlcn/mlcn2 values when the multiplication wraps. This is the change described as 'fs/ntfs3: fix integer overflow in MFT cluster validation' (fs/ntfs3/run.c is referenced).
Linux kernel fs/ntfs3 (ntfs_init_from_boot()/MFT cluster validation) MFT cluster validation arithmetic = Use check_mul_overflow() and fail if multiplication wraps; replace multiplication overflow-prone comparisons (mlcn * sct_per_clst >= sectors or mlcn2 * sct_per_clst >= sectors) with overflow-checked logic (e.g., using check_mul_overflow() and the existing semantics)
Event History
Frequently Asked Questions
What systems are exposed to this issue?
Systems that mount an NTFS volume using the Linux kernel's ntfs3 filesystem driver are exposed to malformed boot-sector MFT cluster values. The affected values are read directly from the mounted volume's boot sector.
What does an attacker need to trigger the flawed validation?
An attacker needs to provide an NTFS volume with an excessively large MFT cluster number or MFT mirror cluster number such that multiplication by sectors per cluster wraps in u64 arithmetic. This can cause the volume's malformed metadata to pass the initial volume-size validation.
What is the observed impact described for malformed volumes?
The resulting MFT location is used unchanged, but reads currently fail at the block layer because of an overflow guard. In practice, the reported behavior is a mount failure in an unexpected location rather than a more dangerous outcome.
How can an administrator recognize a possible encounter with this issue?
The provided information indicates that mounting a specially malformed NTFS volume may fail, with the failure occurring after the incorrect MFT cluster validation has accepted the value. It does not provide a specific log message or other definitive detection indicator.