CVE-2026-43245 Overview
CVE-2026-43245 is a Linux kernel vulnerability in the NTFS filesystem implementation. The flaw stems from the ->d_compare() callback performing blocking memory allocations through __getname(). Dentry comparison operations run in atomic contexts and must not block, making this an incorrect API usage that can lead to scheduling violations under filesystem load.
The fix replaces __getname() calls in ntfs_d_compare() and ntfs_d_hash() with kmalloc(PATH_MAX, GFP_NOWAIT). Additional cleanup removes inappropriate use of names_cachep for non-pathname allocations, switching them to k[mz]alloc().
Critical Impact
Blocking allocations in ->d_compare() violate VFS atomic-context requirements and can cause kernel instability when accessing NTFS volumes.
Affected Products
- Linux kernel NTFS filesystem driver
- Distributions shipping affected kernel versions
- Systems mounting NTFS volumes using the in-tree driver
Discovery Timeline
- 2026-05-06 - CVE-2026-43245 published to NVD
- 2026-05-06 - Last updated in NVD database
Technical Details for CVE-2026-43245
Vulnerability Analysis
The Linux Virtual File System (VFS) layer invokes ->d_compare() during dentry cache lookups. These callbacks execute under RCU read-side critical sections or with seqlocks held, prohibiting any operation that may sleep. The NTFS implementation called __getname(), which allocates from names_cachep using flags that permit blocking.
Under memory pressure, __getname() can sleep waiting for slab reclaim. Sleeping inside ->d_compare() produces scheduling-while-atomic conditions and can corrupt RCU state. The same anti-pattern existed in ntfs_d_hash(), which is also invoked from atomic paths during hash computation.
The kernel maintainers also identified broader misuse of names_cachep across the NTFS driver. Several call sites allocated PATH_MAX-sized buffers for data unrelated to pathnames, wasting memory and conflating allocation pools.
Root Cause
The root cause is improper API selection within atomic VFS callbacks. __getname() does not guarantee non-blocking behavior, and the NTFS code path assumed allocation success without considering the caller's execution context. This represents a kernel filesystem driver defect rather than a memory safety bug.
Attack Vector
The attack vector requires local filesystem activity against an NTFS volume. A user with permission to traverse NTFS-mounted directories can trigger dentry comparisons during path resolution. Under memory pressure, the blocking allocation path becomes reachable, producing kernel warnings or instability. The vulnerability does not provide remote exploitation primitives based on the available data.
The vulnerability mechanism is documented in the upstream commits. See the Kernel Git Commit Overview, secondary commit reference, and tertiary commit reference for the precise patch contents.
Detection Methods for CVE-2026-43245
Indicators of Compromise
- Kernel log entries containing BUG: scheduling while atomic originating from ntfs_d_compare or ntfs_d_hash stack frames.
- sleeping function called from invalid context warnings referencing NTFS dentry operations.
- Kernel oops or soft lockup traces during heavy NTFS directory traversal under memory pressure.
Detection Strategies
- Audit running kernel versions across the fleet against the patched stable kernel commits to identify unpatched hosts.
- Parse dmesg and /var/log/kern.log for stack traces involving ntfs_d_compare, ntfs_d_hash, or __getname invoked from RCU contexts.
- Inventory mounted filesystems to identify systems using the in-tree NTFS driver and prioritize them for patching.
Monitoring Recommendations
- Forward kernel ring buffer events to a centralized logging or SIEM platform for trace pattern matching.
- Alert on repeated scheduling while atomic warnings, which indicate active triggering of the defect.
- Monitor system stability metrics on hosts with NTFS workloads, including unexpected reboots and watchdog timeouts.
How to Mitigate CVE-2026-43245
Immediate Actions Required
- Apply vendor-provided kernel updates that include the upstream NTFS dentry operation fixes.
- Schedule reboots on affected hosts to load the patched kernel image.
- Restrict mounting of untrusted NTFS volumes by non-administrative users until patches are deployed.
Patch Information
The upstream fix replaces __getname() with kmalloc(PATH_MAX, GFP_NOWAIT) in ntfs_d_compare() and ntfs_d_hash(), and removes inappropriate names_cachep usage elsewhere in the NTFS driver. The relevant commits are 142c444a395f, ca2a04e84af7, and fb4b1f969ba0 in the stable kernel tree. Distribution kernels backporting these commits should be tracked through standard vendor advisories.
Workarounds
- Avoid mounting NTFS volumes on affected kernels where feasible, using FAT32 or exFAT alternatives for removable media.
- Reduce memory pressure on hosts that must access NTFS volumes to lower the probability of triggering blocking allocations.
- Use the userspace ntfs-3g FUSE driver as an alternative path that does not invoke the in-tree dentry operations.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
