CVE-2026-90048: Linux Kernel NTFS3 Buffer Overflow Flaw

CVE-2026-90048 Overview

CVE-2026-90048 is a heap out-of-bounds write in the Linux kernel fs/ntfs3 driver, specifically in the ni_create_attr_list() function. The function allocates a fixed buffer sized to al_aligned(record_size) and then iterates over every attribute in the primary Master File Table (MFT) record, writing one ATTR_LIST_ENTRY per attribute without validating the cursor against the buffer boundary. A crafted NTFS image containing a record packed with unnamed minimum-size resident attributes produces an attribute list larger than the allocated buffer, corrupting adjacent heap memory in the kmalloc-1k slab.

Critical Impact
A local attacker with the ability to mount a crafted NTFS image and trigger setxattr can overflow a slab allocation, enabling potential kernel memory corruption and privilege escalation.

Affected Products

Linux kernel fs/ntfs3 filesystem driver
Distributions shipping kernels with the NTFS3 driver enabled prior to the referenced stable commits
Systems permitting loop-mounted or user-supplied NTFS images

Discovery Timeline

2026-09-16 - CVE-2026-90048 published to the National Vulnerability Database (NVD)
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-90048

Vulnerability Analysis

The defect is a heap-based out-of-bounds write [CWE-787] in the NTFS3 attribute list construction path. ni_create_attr_list() pre-allocates a buffer of record_size bytes and assumes it can hold one ATTR_LIST_ENTRY per attribute enumerated from the primary MFT record. The loop advances the write cursor by le_size(name_len) for each attribute without comparing against the buffer end. The total serialized size is computed only after the loop completes, leaving no protection during the write phase.

A minimum-size resident attribute occupies SIZEOF_RESIDENT (0x18, 24 bytes) on disk, but an unnamed attribute expands to le_size(0) (0x20, 32 bytes) in the list. The list therefore grows faster than the on-disk record. Because mi_enum_attr() accepts arbitrarily many equal-type nameless minimum-size attributes, an attacker can pack a record with entries whose serialized list exceeds record_size.

KASAN reports the corruption as a 4-byte write immediately past the end of a 1024-byte kmalloc-1k object, landing at object+1024. The overflow overwrites adjacent slab metadata or neighboring objects, providing a primitive for further exploitation.

Root Cause

The root cause is missing bounds validation between the allocated buffer size and the cumulative size of ATTR_LIST_ENTRY records written during attribute enumeration. The fix sizes the buffer from the actual attributes rather than assuming a single record_size is always sufficient.

Attack Vector

Exploitation requires an attacker to supply a crafted NTFS filesystem image. On a loop-mounted image, opening a target file and invoking setxattr drives the call chain ntfs_set_ea() -> ni_insert_resident() -> ni_insert_attr() -> ni_ins_attr_ext() -> ni_create_attr_list(), triggering the overflow. The KASAN trace observed the write from a setfattr process (PID 345) invoking __arm64_sys_setxattr.

// Vulnerability call chain (no synthetic exploit code provided)
ntfs_setxattr
  -> ntfs_set_ea
    -> ni_insert_resident
      -> ni_insert_attr
        -> ni_ins_attr_ext
          -> ni_create_attr_list   // slab-out-of-bounds write here

Detection Methods for CVE-2026-90048

Indicators of Compromise

KASAN reports containing slab-out-of-bounds in ni_create_attr_list with writes landing at object+1024 in the kmalloc-1k cache.
Kernel oops or panic traces referencing ni_create_attr_list, ni_ins_attr_ext, or ntfs_set_ea following mount of an untrusted NTFS image.
Unexpected mount -o loop or mount -t ntfs3 operations against user-writable image files.

Detection Strategies

Monitor mount syscalls and audit logs for ntfs3 filesystem mounts originating from non-administrative sources or referencing image files in user-writable paths.
Correlate setxattr and setfattr activity on freshly mounted NTFS volumes with subsequent kernel warnings or crashes.
Enable KASAN on test builds to catch out-of-bounds writes in the NTFS3 code paths prior to production deployment.

Monitoring Recommendations

Ingest kernel ring buffer (dmesg) and /var/log/kern.log into centralized logging to alert on ni_create_attr_list stack frames.
Track process lineage for setfattr, attr, and equivalent xattr-manipulation tools running against removable or loop-mounted media.
Alert on repeated mount failures or filesystem driver faults that may indicate fuzzing or exploitation attempts.

How to Mitigate CVE-2026-90048

Immediate Actions Required

Apply the upstream stable kernel patches referenced below and reboot affected hosts.
Restrict mounting of untrusted NTFS images by removing the SUID bit from mount helpers and disabling user-mountable removable media where possible.
Blacklist the ntfs3 kernel module on systems that do not require NTFS support using /etc/modprobe.d/.

Patch Information

The issue is fixed in the mainline and stable trees via the following commits: Linux Kernel Commit 7c4841e2, Linux Kernel Commit 7e9aee7e, Linux Kernel Commit a84f3db7, Linux Kernel Commit d07e281f, and Linux Kernel Commit fa2215cf. The fix computes the required buffer size from the actual attributes before writing rather than assuming record_size bytes suffice.

Workarounds

Disable the ntfs3 module: echo 'blacklist ntfs3' > /etc/modprobe.d/blacklist-ntfs3.conf and rebuild the initramfs.
Enforce noexec, nosuid, and nodev mount options for any user-accessible filesystem and prohibit unprivileged loop-device mounts via polkit or udisks policy.
Where NTFS support is required, limit mounting to administrators only and validate image provenance before mounting.

bash

# Prevent loading of the vulnerable ntfs3 driver
echo 'blacklist ntfs3' | sudo tee /etc/modprobe.d/blacklist-ntfs3.conf
sudo modprobe -r ntfs3 2>/dev/null || true
sudo update-initramfs -u