CVE-2026-90117 in Linux
Summary
by MITRE • 09/17/2026
In the Linux kernel, the following vulnerability has been resolved:
ntfs: validate usa_ofs before preserving the update sequence number
When ntfs_mft_record_alloc() reuses a free mft record it reads the old update sequence number straight from the on-disk record:
usn = *(__le16 *)((u8 *)m + le16_to_cpu(m->usa_ofs));
Here m points into the raw $MFT page-cache folio, which still holds unvalidated, MST-protected bytes: the folio is read by a plain iomap_read_folio() and neither post_read_mst_fixup() nor ntfs_mft_record_check() has run on it (both work on private copies). m->usa_ofs is therefore an untrusted u16, and a corrupted record can put it past the end of the record so the two-byte read lands outside the folio. Reading such a record while creating a file gives, under KASAN:
BUG: KASAN: use-after-free in ntfs_mft_record_alloc+... Read of size 2 at addr ... ntfs_mft_record_alloc -> __ntfs_create -> ntfs_create -> path_openat
Only preserve the old update sequence number when usa_ofs is even and in range, mirroring the check ntfs_mft_record_check() already applies; otherwise leave usn zero, which the existing restore below skips.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/17/2026
The vulnerability identified within the Linux kernel's NTFS filesystem driver stems from a critical lack of input validation when reusing Master File Table records during file creation operations. The core issue resides in the ntfs_mft_record_alloc function, which is responsible for allocating MFT entries by recycling free records found on disk. When this process occurs, the code attempts to preserve the existing update sequence number (USN) from the raw on-disk data structure without first verifying the integrity or validity of that specific field. Specifically, the implementation reads a two-byte value located at an offset defined by m->usa_ofs directly from the memory page cache folio containing the MFT record. This approach assumes that the offset stored within the corrupted or untrusted disk image is valid and points to a location safely within the bounds of the allocated buffer.
The technical flaw arises because the data being processed has not undergone standard integrity checks before this read operation occurs. The folio holding the raw $MFT data is retrieved via iomap_read_folio, which performs basic I/O operations but does not apply Multi-Stream Table (MST) fixups or run ntfs_mft_record_check. These validation routines are typically reserved for private copies of records to ensure structural consistency and correct byte ordering before any logical processing takes place. By accessing the raw folio directly, the kernel treats m->usa_ofs as a trusted value when it is actually an untrusted u16 that may have been corrupted by disk errors or maliciously crafted filesystem images. If this offset exceeds the boundaries of the record or points to invalid memory regions, the subsequent two-byte read operation accesses memory outside the intended folio boundary.
This out-of-bounds access triggers a Kernel Address Sanitizer (KASAN) error classified as a use-after-free condition under specific testing conditions, although technically it represents an out-of-bounds read that can lead to undefined behavior or kernel panic depending on what lies beyond the buffer edge. The operational impact is significant because this code path is executed during standard file creation operations via ntfs_create and __ntfs_create. An attacker with access to a corrupted NTFS volume, or one capable of injecting malicious MFT records through mounted storage devices, could exploit this flaw to cause a denial of service by crashing the kernel. In more complex scenarios involving specific memory layouts, such out-of-bounds reads might potentially leak sensitive information from adjacent kernel memory structures into user space if the read values are subsequently used in ways that expose their contents, although the primary immediate risk is system stability and availability.
From a standards perspective, this vulnerability aligns with CWE-125 Out-of-bounds Read, as the application accesses data beyond the intended buffer boundary due to insufficient validation of input parameters derived from external sources. It also relates to CWE-20 Improper Input Validation, specifically regarding the failure to verify that an offset value is within acceptable limits before performing memory access operations. In terms of adversarial tactics, this flaw could be leveraged in attacks categorized under ATT&CK technique T1498 Network Denial of Service, where a corrupted filesystem image triggers kernel instability, effectively disrupting service availability for systems relying on NTFS storage.
The mitigation implemented addresses the root cause by introducing explicit validation checks before preserving the old update sequence number. The code now verifies that m->usa_ofs is an even value and falls within the valid range of the MFT record size. This mirrors the logic already present in ntfs_mft_record_check, ensuring consistency across different parts of the driver. If these conditions are not met, indicating a corrupted or unsafe record structure, the function sets the update sequence number to zero. The existing restore mechanism subsequently skips preservation when this value is zero, effectively neutralizing the risk without requiring complex error handling paths that might introduce new bugs. This fix ensures that only structurally valid records contribute their metadata during allocation, thereby preventing out-of-bounds memory accesses and enhancing the robustness of the NTFS driver against malformed disk images.