CVE-2026-31716 Overview
CVE-2026-31716 is an out-of-bounds write vulnerability [CWE-787] in the Linux kernel's fs/ntfs3 filesystem driver. The flaw resides in check_file_record(), which validates rec->total against the record size but fails to validate rec->used. Journal-replay handlers in do_action() read rec->used from disk and use it to compute memmove lengths during DeleteAttribute, CreateAttribute, and change_attr_size operations. When rec->used falls outside expected bounds, the resulting subtractions underflow, causing the kernel to copy large memory regions into a 4 KB buffer. Triggering the bug requires mounting a crafted NTFS filesystem image, making it a local attack vector with user interaction.
Critical Impact
A crafted NTFS volume can trigger an arbitrary out-of-bounds memory write during journal replay, potentially leading to kernel memory corruption, privilege escalation, or denial of service.
Affected Products
- Linux Kernel (multiple stable branches)
- Linux Kernel 7.1-rc1
- Systems mounting NTFS volumes via the ntfs3 driver
Discovery Timeline
- 2026-05-01 - CVE-2026-31716 published to NVD
- 2026-05-06 - Last updated in NVD database
Technical Details for CVE-2026-31716
Vulnerability Analysis
The ntfs3 driver in the Linux kernel processes NTFS Master File Table (MFT) records during filesystem operations and journal replay. Each record header contains two relevant fields: rec->total, indicating the full record size, and rec->used, indicating how much of the record contains valid attribute data. The check_file_record() function performs sanity checking on rec->total but never validates that rec->used falls within the record bounds. This omission allows attacker-controlled values to flow directly into length calculations performed during journal replay.
The do_action() handlers compute destination lengths using arithmetic such as used - asize - roff, used - roff, and used - PtrOffset(rec, next). When rec->used is smaller than the validated attribute offset, the subtraction wraps around, producing a very large unsigned value. The kernel then issues a memmove with that length against a 4 KB record buffer, writing far past its allocation boundary. The fix bounds rec->used correctly within check_file_record(), mirroring the approach taken in commit b2bc7c44ed17 for DeleteIndexEntryRoot.
Root Cause
The root cause is missing input validation on disk-supplied metadata [CWE-787]. The rec->used field is trusted without verification that it lies within [header_size, rec->total], allowing attacker-controlled underflow in pointer arithmetic.
Attack Vector
Exploitation requires local access and user interaction to mount a malicious NTFS filesystem image. An attacker can craft an image with a corrupted MFT record where rec->used is set to a value smaller than a validated attribute offset. When the kernel executes journal replay on the image, the underflow triggers an out-of-bounds memmove, corrupting adjacent kernel heap memory. This is particularly relevant for systems with auto-mount features or USB device handling that processes untrusted removable media.
No verified public exploit is available. Refer to the upstream patch commits listed under Kernel Git Commit 0112e62 for technical implementation details.
Detection Methods for CVE-2026-31716
Indicators of Compromise
- Kernel panic or BUG/KASAN reports referencing ntfs3, do_action, check_file_record, or memmove during NTFS mount operations.
- Unexpected mount of NTFS volumes from removable media or user-supplied disk images on servers and workstations.
- dmesg entries containing ntfs3: errors immediately preceding system instability or a crash.
Detection Strategies
- Audit mount syscalls invoking the ntfs3 filesystem type, particularly from non-root users or automounter daemons.
- Monitor kernel log streams for slab-out-of-bounds, KASAN, or general protection fault signatures originating in fs/ntfs3 code paths.
- Inventory hosts running affected kernel versions and correlate with workloads that consume external NTFS media.
Monitoring Recommendations
- Forward /var/log/kern.log and journalctl -k output to a centralized logging platform for kernel oops correlation.
- Alert on USB mass-storage insertion events followed by ntfs3 mount activity on production hosts.
- Track patch-level coverage across Linux fleets to confirm rollout of the fixed kernel builds.
How to Mitigate CVE-2026-31716
Immediate Actions Required
- Apply the upstream kernel patches referenced by commits 0112e627, 0ca0485e, 4b1613d7, f79d0403, and f90b8a17 from your distribution vendor.
- Disable auto-mounting of removable media on systems where NTFS support is not required.
- Restrict the mount capability and unprivileged user namespaces that allow filesystem mounting.
Patch Information
The vulnerability is resolved upstream in the Linux kernel via multiple stable backports. The fix bounds rec->used within check_file_record() before any journal-replay handler consumes it. Refer to the official commits: Kernel Git Commit 0112e62, Kernel Git Commit 0ca0485, Kernel Git Commit 4b1613d, Kernel Git Commit f79d040, and Kernel Git Commit f90b8a1.
Workarounds
- Blacklist the ntfs3 kernel module on hosts that do not require NTFS read/write support.
- Enforce policy that prevents mounting of untrusted NTFS images by non-administrative users.
- Use sandboxed or virtualized environments to inspect untrusted disk images instead of mounting them on production kernels.
# Blacklist the ntfs3 module to prevent mounting untrusted NTFS volumes
echo "blacklist ntfs3" | sudo tee /etc/modprobe.d/blacklist-ntfs3.conf
sudo update-initramfs -u
# Verify the module is not loaded
lsmod | grep ntfs3
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
