CVE-2026-45864 Overview
CVE-2026-45864 is a Linux kernel vulnerability in the fs/ntfs3 filesystem subsystem. The flaw allows an infinite loop condition when processing a valid value within the range [valid : pos). If the retrieved valid value remains unchanged across iterations, the loop never terminates. This triggers a task hang condition similar to the issue reported by syzbot, where ntfs_file_write_iter blocks on inode_lock for extended periods. The vulnerability has been resolved by adding a sanity check inside the loop body that terminates execution with -EINVAL when the next valid matches the current value.
Critical Impact
A local actor mounting or interacting with a crafted NTFS filesystem can trigger a kernel task hang, leading to denial of service through resource exhaustion and blocked inode locks.
Affected Products
- Linux kernel fs/ntfs3 filesystem driver
- Multiple stable Linux kernel branches receiving backported fixes
- Systems mounting NTFS volumes using the in-tree ntfs3 driver
Discovery Timeline
- 2026-05-27 - CVE-2026-45864 published to NVD
- 2026-05-27 - Last updated in NVD database
Technical Details for CVE-2026-45864
Vulnerability Analysis
The vulnerability resides in the NTFS3 filesystem code path that processes the valid data range [valid : pos). The loop advances based on the next valid value retrieved during each iteration. When this retrieval returns an identical value repeatedly, the loop fails to progress.
The syzbot report shows the kernel task syz.4.21 blocked for more than 143 seconds inside ntfs_file_write_iter at fs/ntfs3/file.c:1284. The call trace traverses inode_lock and rwbase_write_lock in kernel/locking/rwbase_rt.c. Because the inode write lock is held during the loop, additional callers contending for the same inode also stall. This classifies as an Infinite Loop denial of service condition affecting kernel availability.
Root Cause
The fs/ntfs3 write path does not validate that the next valid value differs from the previous iteration's value. A malformed or attacker-controlled NTFS structure can supply a stale valid offset that never advances toward pos, causing unbounded iteration while holding the inode mutex.
Attack Vector
A local actor with the ability to mount a crafted NTFS image or write to an NTFS volume can trigger the hang. The vulnerability requires interaction with the NTFS3 driver and does not provide code execution, but produces task hangs and lock contention that degrade system availability. The upstream fix adds a check that compares the new valid to the current value and returns -EINVAL when they match, terminating the loop safely. See the Kernel Git Commit 50c822f for the canonical patch.
Detection Methods for CVE-2026-45864
Indicators of Compromise
- Kernel log entries reporting task ... blocked for more than N seconds referencing ntfs_file_write_iter
- Call traces containing rwbase_write_lock and inode_lock originating from fs/ntfs3/file.c
- Unexpected mounting of NTFS images from untrusted sources on production hosts
Detection Strategies
- Monitor dmesg and /var/log/kern.log for hung_task warnings that reference ntfs3 symbols
- Audit kernel versions across the fleet to identify hosts running unpatched fs/ntfs3 code
- Inspect mount events for NTFS volumes attached from removable media or user-supplied images
Monitoring Recommendations
- Enable kernel.hung_task_timeout_secs alerting and forward kernel hang traces to a centralized logging platform
- Track process state transitions for tasks stuck in D (uninterruptible sleep) on NTFS-backed mounts
- Correlate filesystem mount telemetry with subsequent kernel task hangs to identify malicious images
How to Mitigate CVE-2026-45864
Immediate Actions Required
- Apply the upstream kernel patches referenced in the stable tree commits and rebuild affected kernels
- Restrict mounting of untrusted NTFS images to non-production, isolated systems
- Disable automatic mounting of removable NTFS media on servers that do not require it
Patch Information
The fix is distributed across multiple stable kernel branches. Reference commits include Kernel Git Commit 27b75ca, Kernel Git Commit 4bf3baf, Kernel Git Commit 50c822f, Kernel Git Commit 6d93239, Kernel Git Commit 71c8b96, Kernel Git Commit a47a2bb, and Kernel Git Commit b97e371. The patch adds an equality check on the valid value inside the loop and returns -EINVAL to break the cycle.
Workarounds
- Blacklist the ntfs3 kernel module on systems that do not require NTFS read/write support
- Mount NTFS volumes read-only where write access is unnecessary to avoid the affected write path
- Apply mandatory access control policies that prevent unprivileged users from mounting filesystems
# Blacklist the ntfs3 module until the kernel is patched
echo "blacklist ntfs3" | sudo tee /etc/modprobe.d/blacklist-ntfs3.conf
sudo update-initramfs -u
# Verify the module is not loaded after reboot
lsmod | grep ntfs3
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
