CVE-2026-45935: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-45935 Overview

CVE-2026-45935 is a slab-out-of-bounds read vulnerability in the Linux kernel's fs/ntfs3 filesystem driver. The flaw resides in the DeleteIndexEntryRoot case of the do_action function, where the entry size (esize) is read from a log record without adequate bounds checking. A maliciously crafted NTFS log record can supply an oversized esize value, causing subsequent pointer arithmetic to produce a negative offset. When this offset is cast to size_t for a memmove operation, it becomes a large unsigned integer and triggers a heap buffer overflow during memory copy.

Critical Impact
A crafted NTFS image processed by the ntfs3 driver can trigger out-of-bounds memory access in kernel space, leading to memory corruption or denial of service.

Affected Products

Linux kernel fs/ntfs3 filesystem driver
Stable kernel branches containing the unfixed do_action handler for DeleteIndexEntryRoot
Systems mounting untrusted NTFS volumes via the in-tree ntfs3 driver

Discovery Timeline

2026-05-27 - CVE-2026-45935 published to NVD
2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-45935

Vulnerability Analysis

The vulnerability occurs inside the do_action function of the NTFS3 log replay logic. When handling the DeleteIndexEntryRoot operation, the code reads the entry size (esize) directly from the log record. The driver then computes the end-of-entry pointer with e2 = Add2Ptr(e1, esize); and uses PtrOffset(e2, ...) to determine the byte count for a subsequent memmove call.

If esize is larger than the remaining valid buffer space, e2 points past the end of the used buffer region. The resulting PtrOffset calculation produces a negative integer. Because memmove accepts a size_t length argument, the negative value is reinterpreted as a very large positive size. The driver then performs an out-of-bounds memory operation in kernel heap memory.

Root Cause

The root cause is missing input validation [CWE-125, CWE-787-adjacent] on the attacker-controlled esize field within an NTFS log record. The code did not verify that esize fits within the remaining used space of the index header before computing derived pointers. The patch adds a strict bounds check ensuring esize does not exceed the valid region of the index header buffer prior to performing any pointer arithmetic or memory copy.

Attack Vector

Exploitation requires the kernel to process a malicious NTFS volume or log stream. An attacker who can present a crafted NTFS image, such as via a USB device, removable media, or a mountable disk image, can trigger the vulnerable path during NTFS log replay. Successful triggering causes the kernel to perform out-of-bounds reads or writes within slab-allocated memory, which can result in kernel panic, information disclosure from adjacent slab objects, or further memory corruption.

No public proof-of-concept code is referenced in the advisory. Refer to the upstream commits in the Linux kernel stable tree for the exact code changes implementing the bounds check.

Detection Methods for CVE-2026-45935

Indicators of Compromise

Kernel oops, panic, or KASAN reports referencing do_action, DeleteIndexEntryRoot, or ntfs3 symbols in dmesg or /var/log/kern.log.
Unexpected memmove faults or slab-out-of-bounds warnings emitted by KASAN-enabled kernels during NTFS mount or log replay.
Mount attempts of untrusted NTFS volumes from removable media or disk images on hosts running the ntfs3 driver.

Detection Strategies

Enable Kernel Address Sanitizer (KASAN) on test or canary systems to surface out-of-bounds reads in fs/ntfs3 code paths.
Audit kernel logs for crashes or warnings tied to NTFS log replay following insertion of removable storage.
Inventory hosts running kernel versions that include the ntfs3 driver but predate the fix commits referenced in the advisory.

Monitoring Recommendations

Monitor mount events for filesystems of type ntfs3 originating from non-fixed media using auditd or equivalent.
Forward kernel ring buffer messages to a centralized log platform to identify crash patterns affecting multiple hosts.
Track patch state across the fleet by correlating kernel build identifiers with the upstream stable commits that resolve this issue.

How to Mitigate CVE-2026-45935

Immediate Actions Required

Update to a Linux kernel version that incorporates the upstream fix commits listed in the advisory.
Restrict the ability of unprivileged users to mount NTFS volumes from removable or attacker-controlled media.
Disable automatic mounting of removable storage on servers and high-value endpoints until the patched kernel is deployed.

Patch Information

The fix adds a check ensuring esize strictly fits within the remaining used space of the index header before any memory operations occur. The patch is distributed across multiple stable branches via the following commits: 36c03f7f, 78942172, a584b9d1, b271c9cb, b2bc7c44, c065541b, and f3b437a4. Apply the kernel update appropriate to your distribution and reboot affected hosts.

Workarounds

Blacklist the ntfs3 kernel module on systems that do not require NTFS read/write support.
Use the FUSE-based ntfs-3g driver in userspace as an alternative until the in-tree ntfs3 driver is patched.
Enforce policies that prevent mounting of untrusted NTFS images, including USB autorun restrictions and removable-media controls.

bash

# Blacklist the ntfs3 kernel module until the patch is applied
echo 'blacklist ntfs3' | sudo tee /etc/modprobe.d/blacklist-ntfs3.conf
sudo update-initramfs -u
# Verify the module is not loaded after reboot
lsmod | grep ntfs3