CVE-2026-98135: ntfs: reject invalid sectors_per_cluster in the boot sector
In the Linux kernel, the following vulnerability has been resolved:
ntfs: reject invalid sectorspercluster in the boot sector
isbootsectorntfs() checks the boot sector's sectorspercluster field with a range test that rejects 0x81..0xf3 but accepts 0 and other non-power-of-two counts. A zero value reaches parsentfsbootsector():
sectorsperclusterbits = ffs(sectorspercluster) - 1; ... vol->clustersize = vol->sectorsize << sectorsperclusterbits;
ffs(0) is 0, so sectorsperclusterbits becomes (unsigned)-1 and the shift is undefined:
UBSAN: shift-out-of-bounds in fs/ntfs/super.c:673:39 shift exponent 4294967295 is too large for 32-bit type 'int'
This change rejects any non-power-of-two value, since it feeds the aforementioned shift via ffs() - 1, which only yields the correct shift for a power of two.
Affected Software
Event History
Frequently Asked Questions
What input is required to trigger the vulnerable path?
The system must parse an NTFS boot sector whose sectors_per_cluster field is zero or another non-power-of-two value. The invalid value reaches the NTFS boot-sector parser and is used to derive a shift count.
How can I identify a possible occurrence?
A UBSAN-enabled kernel may report a shift-out-of-bounds warning in fs/ntfs/super.c, with a shift exponent of 4294967295 for a 32-bit int. This is consistent with a sectors_per_cluster value of zero.
What can be done before the fix is available?
Avoid mounting NTFS filesystems with malformed or untrusted boot sectors, particularly where sectors_per_cluster is zero or not a power of two. The fix rejects non-power-of-two values before they reach the unsafe shift calculation.