CVE-2006-6060 in Linux
Summary
by MITRE
The NTFS filesystem code in Linux kernel 2.6.x up to 2.6.18, and possibly other versions, allows local users to cause a denial of service (CPU consumption) via a malformed NTFS file stream that triggers an infinite loop in the __find_get_block_slow function.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 04/28/2026
The vulnerability described in CVE-2006-6060 represents a critical flaw in the Linux kernel's NTFS filesystem implementation that affects versions 2.6.x up to 2.6.18 and potentially other variants. This issue manifests as a local privilege escalation opportunity that can result in system-wide denial of service through excessive cpu consumption. The flaw specifically targets the ntfs filesystem driver within the kernel's block management system, creating a scenario where maliciously crafted ntfs file streams can trigger unintended system behavior that ultimately consumes all available cpu cycles.
The technical root cause of this vulnerability lies within the __find_get_block_slow function which is responsible for handling block lookups in ntfs filesystems. When processing malformed ntfs file streams, the function enters an infinite loop due to improper validation of file stream parameters. This infinite loop occurs because the code fails to properly check for boundary conditions or malformed data structures within the ntfs stream metadata. The flaw demonstrates poor input validation practices and inadequate error handling mechanisms that are fundamental to secure kernel programming. According to CWE-121, this vulnerability falls under the category of stack-based buffer overflow conditions, though in this specific case the manifestation is through an infinite loop rather than memory corruption. The vulnerability operates at the kernel level where privilege escalation is not required for exploitation since local users can trigger the condition through normal file system operations.
The operational impact of this vulnerability extends beyond simple denial of service to potentially compromise system stability and availability. When exploited, the infinite loop consumes 100% cpu resources, effectively rendering the system unresponsive to legitimate user requests and system processes. This type of attack can be particularly devastating in server environments where continuous availability is critical, as it can lead to complete system lockups and require manual intervention to restore normal operations. The vulnerability affects any system running affected kernel versions that have ntfs filesystem support enabled, making it a widespread concern across various linux distributions that utilize these kernel versions. The attack vector is relatively simple and accessible to local users, which means that even users with minimal privileges can potentially exploit this vulnerability to cause system-wide disruption.
Mitigation strategies for CVE-2006-6060 involve multiple layers of protection that address both immediate system stability and long-term security posture. The most effective immediate solution is to upgrade to kernel versions that contain the patched ntfs filesystem implementation, specifically those beyond version 2.6.18 where the vulnerability has been addressed. System administrators should also implement monitoring solutions that can detect abnormal cpu usage patterns that may indicate exploitation attempts. Additionally, disabling ntfs filesystem support entirely on systems that do not require it provides a strong defense in depth approach. From an operational security perspective, implementing proper input validation and boundary checking mechanisms in filesystem drivers aligns with ATT&CK technique T1068 which focuses on exploiting privileges through kernel-level vulnerabilities. Organizations should also consider implementing network segmentation to limit the potential impact of such local privilege escalation attacks and ensure that systems running affected kernels are properly monitored for unusual resource consumption patterns.