CVE-2026-90048 in Linux
Summary
by MITRE • 09/16/2026
In the Linux kernel, the following vulnerability has been resolved:
fs/ntfs3: fix slab-out-of-bounds write in ni_create_attr_list()
ni_create_attr_list() allocates a fixed buffer of al_aligned(record_size) (== record_size) bytes and then walks every attribute of the primary MFT record, writing one ATTR_LIST_ENTRY per attribute and advancing the cursor by le_size(name_len), with no check against the end of the buffer; the total size is only computed after the loop.
A minimum-size resident attribute occupies SIZEOF_RESIDENT (0x18 = 24) bytes on disk, but an unnamed attribute expands to le_size(0) (0x20 = 32) bytes in the list. Because the number of attributes in a record is not bounded (mi_enum_attr() accepts arbitrarily many equal-type, nameless minimum-size attributes), a crafted record packed with such attributes produces a list larger than record_size and overflows the heap buffer.
This is reachable from a crafted, loop-mounted NTFS image: opening the file and adding an attribute (e.g. via setxattr) drives ntfs_set_ea() -> ni_insert_resident() -> ni_insert_attr() -> ni_ins_attr_ext() -> ni_create_attr_list().
BUG: KASAN: slab-out-of-bounds in ni_create_attr_list+0xc48/0x1058 Write of size 4 at addr ffff000008984c00 by task setfattr/345 ni_create_attr_list+0xc48/0x1058 ni_ins_attr_ext+0x510/0x7c0 ni_insert_attr+0x3f8/0x70c ni_insert_resident+0xc8/0x3b0 ntfs_set_ea+0x66c/0xd28 ntfs_setxattr+0x4d8/0x5b0 __arm64_sys_setxattr+0xa4/0x124 Allocated by task 345: ni_create_attr_list+0x188/0x1058 The buggy address belongs to the cache kmalloc-1k of size 1024 (the write lands at object+1024).
Size the buffer from the actual attributes instead of assuming a single record_size is always enough.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/16/2026
The Linux kernel's NTFS3 filesystem driver contains a critical heap-based buffer overflow vulnerability located within the ni_create_attr_list function, which was addressed in recent kernel updates. This flaw stems from an incorrect assumption regarding memory allocation sizes during the processing of Master File Table records. Specifically, when creating an attribute list for an MFT record, the code allocates a fixed-size buffer based on the total size of the primary record itself rather than calculating the actual space required to store all individual attributes within that record. This architectural oversight fails to account for the expansion in memory footprint that occurs when resident attributes are converted into entries within the attribute list structure.
The technical root cause lies in the discrepancy between disk representation and in-memory representation of NTFS attributes. A minimum-size resident attribute occupies only twenty-four bytes on disk, defined by SIZEOF_RESIDENT. However, when this same attribute is processed to build an ATTR_LIST_ENTRY for the attribute list, it expands to thirty-two bytes due to additional metadata overhead such as name length fields and alignment requirements. The vulnerability exploits this difference by allowing a crafted NTFS image containing a high density of small, unnamed resident attributes within a single MFT record. Because the kernel does not validate that the cumulative size of these expanded entries exceeds the pre-allocated buffer limit before writing to it, an attacker can trigger a slab-out-of-bounds write condition.
This vulnerability is reachable through local file system operations on loop-mounted NTFS volumes with maliciously crafted images. The attack vector involves opening a file within the compromised filesystem and invoking setxattr or similar extended attribute manipulation functions. This action triggers a call chain that proceeds from ntfs_set_ea to ni_insert_resident, then to ni_insert_attr, followed by ni_ins_attr_ext, ultimately reaching the vulnerable ni_create_attr_list function. The lack of bounds checking during the iteration over attributes allows an attacker with local access and appropriate privileges to write beyond the allocated heap buffer boundaries, potentially leading to memory corruption, kernel panic, or arbitrary code execution depending on the surrounding memory layout and exploitation techniques employed.
From a classification perspective, this issue aligns with CWE-120 Buffer Copy without Checking Size of Input Classic Buffer Overflow and CWE-787 Out-of-bounds Write. In terms of adversarial tactics, it relates to ATT&CK technique T1496 Resource Hijacking or potentially privilege escalation vectors if the memory corruption allows for control flow hijacking. The impact extends beyond simple denial of service; successful exploitation could compromise system integrity and confidentiality by allowing an unprivileged user to overwrite kernel heap structures with crafted data payloads.
To mitigate this vulnerability, users must ensure their Linux systems are updated with the latest kernel patches that include fixes for the NTFS3 driver's attribute list handling logic. The fix involves modifying ni_create_attr_list to accurately size the buffer based on the actual calculated sum of all expanded attribute entries rather than relying on the static record_size parameter. Administrators should also enforce strict validation policies on mounted filesystems, particularly those sourced from untrusted or external media, and consider disabling NTFS3 support if it is not strictly required for system operations to reduce the attack surface. Regular security audits and fuzzing of file system drivers remain essential practices to identify similar logic errors in memory management routines before they can be exploited in production environments.