CVE-2026-97438: fs/ntfs3: validate index entry key bounds
In the Linux kernel, the following vulnerability has been resolved:
fs/ntfs3: validate index entry key bounds
[BUG] A malformed NTFS directory index entry can advertise a keysize larger than the bytes actually present in its NTFSDE payload. Directory lookup then passes that malformed key to cmpfnames(), which can read past the end of the kmalloc'ed index buffer.
BUG: KASAN: slab-out-of-bounds in fnamefullsize fs/ntfs3/ntfs.h:590 [inline] BUG: KASAN: slab-out-of-bounds in cmpfnames+0x1ea/0x230 fs/ntfs3/index.c:46 Read of size 1 at addr ffff88801c313018 by task syz.6.3365/9279
Call Trace: dumpstack lib/dumpstack.c:94 [inline] dumpstacklvl+0xbe/0x130 lib/dumpstack.c:120 printaddressdescription mm/kasan/report.c:378 [inline] printreport+0xd1/0x650 mm/kasan/report.c:482 kasanreport+0xfb/0x140 mm/kasan/report.c:595 asanreportload1noabort+0x14/0x30 mm/kasan/reportgeneric.c:378 fnamefullsize fs/ntfs3/ntfs.h:590 [inline] cmpfnames+0x1ea/0x230 fs/ntfs3/index.c:46 hdrfinde.isra.0+0x3ed/0x670 fs/ntfs3/index.c:762 indxfind+0x4b5/0x900 fs/ntfs3/index.c:1186 dirsearchu+0x2c0/0x460 fs/ntfs3/dir.c:254 ntfslookup+0x1cc/0x2a0 fs/ntfs3/namei.c:85 lookupslow+0x241/0x450 fs/namei.c:1816 lookupslow fs/namei.c:1833 [inline] walkcomponent+0x31c/0x570 fs/namei.c:2151 linkpathwalk+0x592/0xd60 fs/namei.c:2519 pathlookupat+0x138/0x660 fs/namei.c:2675 filenamelookup+0x1f3/0x560 fs/namei.c:2705 filenamesetxattr+0xad/0x1c0 fs/xattr.c:660 pathsetxattrat+0x1d8/0x280 fs/xattr.c:713 dosyslsetxattr fs/xattr.c:754 [inline] sesyslsetxattr fs/xattr.c:750 [inline] x64syslsetxattr+0xd0/0x150 fs/xattr.c:750 ...
Allocated by task 9279: kasansavestack+0x39/0x70 mm/kasan/common.c:56 kasansavetrack+0x14/0x40 mm/kasan/common.c:77 kasansaveallocinfo+0x37/0x60 mm/kasan/generic.c:573 poisonkmallocredzone mm/kasan/common.c:400 [inline] kasankmalloc+0xc3/0xd0 mm/kasan/common.c:417 kasankmalloc include/linux/kasan.h:262 [inline] dokmallocnode mm/slub.c:5650 [inline] kmallocnoprof+0x2bd/0x900 mm/slub.c:5662 kmallocnoprof include/linux/slab.h:961 [inline] indxread+0x41d/0xad0 fs/ntfs3/index.c:1059 indxfind+0x447/0x900 fs/ntfs3/index.c:1179 dirsearchu+0x2c0/0x460 fs/ntfs3/dir.c:254 ntfslookup+0x1cc/0x2a0 fs/ntfs3/namei.c:85 lookupslow+0x241/0x450 fs/namei.c:1816 lookupslow fs/namei.c:1833 [inline] walkcomponent+0x31c/0x570 fs/namei.c:2151 linkpathwalk+0x592/0xd60 fs/namei.c:2519 pathlookupat+0x138/0x660 fs/namei.c:2675 filenamelookup+0x1f3/0x560 fs/namei.c:2705 filenamesetxattr+0xad/0x1c0 fs/xattr.c:660 pathsetxattrat+0x1d8/0x280 fs/xattr.c:713 dosyslsetxattr fs/xattr.c:754 [inline] sesyslsetxattr fs/xattr.c:750 [inline] x64syslsetxattr+0xd0/0x150 fs/xattr.c:750 ...
[CAUSE] The index-header validators only validated INDEXHDR-level geometry. They did not walk each NTFSDE to verify entry alignment, subnode layout, or that keysize fit inside the entry payload. They also allowed a last sentinel entry to carry a non-zero keysize.
[FIX] Walk every NTFSDE in ntfs3's index-header validators and reject entries with invalid layout, mismatched subnode state, oversized keysize, or non-zero sentinel keys before lookup or log replay can consume them.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Update ntfs3 index-header validation to walk every NTFS_DE and reject entries with invalid alignment or layout, mismatched subnode state, oversized key_size that does not fit within the entry payload, or non-zero key_size in the final sentinel entry before lookup or log replay.
Event History
Frequently Asked Questions
What must an attacker control to trigger the issue?
The attacker needs to provide an NTFS filesystem containing a malformed directory index entry whose advertised key_size exceeds the bytes present in its NTFS_DE payload. The out-of-bounds read is reached during directory lookup.
What is the observed impact?
The reported failure is a KASAN-detected slab out-of-bounds read in cmp_fnames(), via fname_full_size(). The read occurs past the end of a kmalloc-allocated index buffer.
How can administrators identify a possible occurrence?
Look for KASAN reports identifying a slab-out-of-bounds read in fname_full_size or cmp_fnames(), with call paths including hdr_find_e, indx_find, dir_search_u, and ntfs_lookup. Such reports during NTFS directory access match the described failure mode.