CVE-2026-90133

Status: UPDATED  |  Advisory ID: CVE-2026-90133

Key Details

Affected Products, Subsystems & Sectors

What to Know

In the Linux kernel, the following vulnerability has been resolved:

ntfs: Fix index_root heap OOB write in ntfs_ir_to_ib()

ntfs_ir_to_ib copies all entries from index_root into a freshly allocated

index_block_size-byte buffer without verifying that the entries fit in the

available space. The entries in index_root may be larger than the usable

entry space in the index block.

This can cause OOB writes past the end of the allocation.

The validator ntfs_index_root_inconsistent() checks that entries are

self-consistent within the IR value, but never cross-checks them against

index_block_size. There is no bounds check in ntfs_ir_to_ib() before the

memcpy.

Fixing this at the sink in ntfs_ir_to_ib() since

ntfs_index_root_inconsistent() validates the logical consistency of

index_root as a structure and a root with large entries is a structurally

valid root. The bug is a size conflict of ntfs_ir_to_ib().

Also, the validator is called once per inode load in

ntfs_read_locked_inode() while ntfs_ir_to_ib() is only called during a

reparent, a check there adds no overhead to the common path.

Moreover, even a future call path that bypasses the validator would still

be protected.

With NULL as first parameter of ntfs_error(), the volume error flag is

never set by this call, so the device name will be absent from the error

message. In any case, that the caller, ntfs_ir_reparent(), prints an error

message that includes the device name on NULL returns.

I think this is the best solution available without adding

'struct super_block *sb' as a parameter to ntfs_ir_to_ib().

This heap out-of-bounds write is triggered by a crafted filesystem image,

which is not in the kernel threat model, anyway, fixing memory errors would

be nice to keep things secure. (NVD)

What to Do

Monitor Linux's web page for any future patch releases.

References