CVE-2026-90133 in Linux
Summary
by MITRE • 09/17/2026
In the Linux kernel, the following vulnerability has been resolved:
ntfs: Fix index_root heap OOB write in ntfs_ir_to_ib()
ntfs_ir_to_ib copies all entries from index_root into a freshly allocated index_block_size-byte buffer without verifying that the entries fit in the available space. The entries in index_root may be larger than the usable entry space in the index block.
This can cause OOB writes past the end of the allocation.
The validator ntfs_index_root_inconsistent() checks that entries are self-consistent within the IR value, but never cross-checks them against index_block_size. There is no bounds check in ntfs_ir_to_ib() before the memcpy.
Fixing this at the sink in ntfs_ir_to_ib() since ntfs_index_root_inconsistent() validates the logical consistency of index_root as a structure and a root with large entries is a structurally valid root. The bug is a size conflict of ntfs_ir_to_ib(). Also, the validator is called once per inode load in ntfs_read_locked_inode() while ntfs_ir_to_ib() is only called during a reparent, a check there adds no overhead to the common path. Moreover, even a future call path that bypasses the validator would still be protected.
With NULL as first parameter of ntfs_error(), the volume error flag is never set by this call, so the device name will be absent from the error message. In any case, that the caller, ntfs_ir_reparent(), prints an error message that includes the device name on NULL returns. I think this is the best solution available without adding 'struct super_block *sb' as a parameter to ntfs_ir_to_ib().
This heap out-of-bounds write is triggered by a crafted filesystem image, which is not in the kernel threat model, anyway, fixing memory errors would be nice to keep things secure.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/17/2026
The Linux kernel's NTFS file system driver contains a critical buffer overflow vulnerability within the ntfs_ir_to_ib function, classified as CWE-120 Buffer Copy without Checking Size of Input in C/C++. This flaw arises during the processing of index root structures where data is copied from an index_root structure into a newly allocated memory buffer sized according to index_block_size. The core technical deficiency lies in the absence of bounds checking before executing a memcpy operation that transfers all entries from the source structure to the destination buffer. Specifically, the function fails to verify whether the cumulative size of the entries contained within the index_root exceeds the capacity of the target index block allocation. This oversight allows for heap out-of-bounds writes when processing malformed or crafted file system images where entry sizes are artificially inflated beyond standard limits.
The vulnerability is rooted in a logical disconnect between validation mechanisms and data handling routines. While the ntfs_index_root_inconsistent validator ensures that entries within an index root structure are self-consistent, it does not cross-check these entries against the constraints imposed by the target index block size. Consequently, a structurally valid but oversized configuration can pass initial integrity checks yet trigger memory corruption when processed later in the reparenting workflow. The ntfs_ir_to_ib function is invoked specifically during inode reparent operations rather than during standard inode loading phases where broader validation might occur. This distinction highlights why fixing the issue at this specific sink point provides robust protection without introducing performance overhead to common code paths that do not trigger this particular execution flow.
From an operational security perspective, exploitation of this vulnerability requires a crafted NTFS file system image mounted by the kernel. Although such inputs fall outside the standard Linux kernel threat model which typically assumes trusted or physically accessible storage media, addressing memory safety issues remains essential for defense in depth and preventing potential privilege escalation if combined with other vulnerabilities. The heap out-of-bounds write can lead to arbitrary code execution, denial of service through system crashes, or information disclosure depending on how the overwritten memory is utilized by subsequent kernel operations. Mitigation involves applying the upstream patch that introduces explicit size verification before performing the copy operation. This ensures that any attempt to process entries exceeding the allocated buffer capacity results in a controlled error return rather than uncontrolled memory modification.
The implementation of this fix strategically places validation at the point of data consumption, ensuring protection even against future code paths that might bypass earlier consistency checks. By handling the error condition within ntfs_ir_to_ib and allowing the caller to manage device-specific logging via super block structures where available, the solution maintains clean separation of concerns while preserving security guarantees. This approach aligns with ATT&CK techniques related to exploitation for privilege escalation or persistence if an attacker can manipulate mounted file systems in a privileged context. Maintaining rigorous bounds checking on all memory copy operations involving external data sources is critical for sustaining kernel integrity and preventing low-level memory corruption vulnerabilities from evolving into significant system compromise vectors.