CVE-2026-90048

Status: UPDATED  |  Advisory ID: CVE-2026-90048

Key Details

Affected Products, Subsystems & Sectors

What to Know

In the Linux kernel, the following vulnerability has been resolved:

fs/ntfs3: fix slab-out-of-bounds write in ni_create_attr_list()

ni_create_attr_list() allocates a fixed buffer of al_aligned(record_size)

(== record_size) bytes and then walks every attribute of the primary MFT

record, writing one ATTR_LIST_ENTRY per attribute and advancing the cursor

by le_size(name_len), with no check against the end of the buffer; the

total size is only computed after the loop.

A minimum-size resident attribute occupies SIZEOF_RESIDENT (0x18 = 24)

bytes on disk, but an unnamed attribute expands to le_size(0) (0x20 = 32)

bytes in the list. Because the number of attributes in a record is not

bounded (mi_enum_attr() accepts arbitrarily many equal-type, nameless

minimum-size attributes), a crafted record packed with such attributes

produces a list larger than record_size and overflows the heap buffer.

This is reachable from a crafted, loop-mounted NTFS image: opening the file

and adding an attribute (e.g. via setxattr) drives ntfs_set_ea() ->

ni_insert_resident() -> ni_insert_attr() -> ni_ins_attr_ext() ->

ni_create_attr_list().

BUG: KASAN: slab-out-of-bounds in ni_create_attr_list+0xc48/0x1058

Write of size 4 at addr ffff000008984c00 by task setfattr/345

ni_create_attr_list+0xc48/0x1058

ni_ins_attr_ext+0x510/0x7c0

ni_insert_attr+0x3f8/0x70c

ni_insert_resident+0xc8/0x3b0

ntfs_set_ea+0x66c/0xd28

ntfs_setxattr+0x4d8/0x5b0

__arm64_sys_setxattr+0xa4/0x124

Allocated by task 345:

ni_create_attr_list+0x188/0x1058

The buggy address belongs to the cache kmalloc-1k of size 1024

(the write lands at object+1024).

Size the buffer from the actual attributes instead of assuming a single

record_size is always enough. (NVD)

What to Do

Monitor Linux's web page for any future patch releases.

References