CVE-2026-98136

Analyzed Analyzed - Analysis Complete

Out-of-Bounds Read in Linux Kernel NTFS Filesystem

Publication date: 2026-09-25

Last updated on: 2026-10-08

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: ntfs: bound $AttrDef table walk to the loaded table size ntfs_attr_find_in_attrdef() walks the in-memory $AttrDef table, but the loop condition bounds only the start of each entry, not the whole entry: for (ad = vol->attrdef; (u8 *)ad - (u8 *)vol->attrdef < vol->attrdef_size && ad->type; ++ad) struct attr_def is 160 bytes; the guard reads ad->type at offset 128 and the loop body reads further fields. vol->attrdef is kvzalloc(i_size), where i_size is the on-disk $AttrDef data size, checked in load_and_init_attrdef() only as 0 < i_size <= 0x7fffffff. A volume whose $AttrDef data size is smaller than one entry (e.g. 120 bytes) makes the read of ad->type run past the allocation. Creating a file reaches this through ntfs_attr_size_bounds_check() and reads out of bounds: BUG: KASAN: slab-out-of-bounds in ntfs_attr_find_in_attrdef+0x66/0xa0 Read of size 4 at addr ffff888005833280 by task init/1 ntfs_attr_find_in_attrdef ntfs_attr_size_bounds_check ntfs_attr_can_be_non_resident ntfs_attr_add Require the whole entry to lie within attrdef_size in the loop guard, and reject at mount a $AttrDef too small to hold one attr_def entry.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-25

Last Modified

2026-10-08

Generated

2026-10-15

AI Q&A

2026-09-25

EPSS Evaluated

2026-10-14

NVD

CVE-2026-98136

EUVD

EUVD-2026-86967

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	7.3
linux	linux_kernel	From 7.1 (inc) to 7.2.7 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-125	The product reads data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

Executive Summary

This vulnerability is in the Linux kernel's NTFS file system driver. It involves a loop in the ntfs_attr_find_in_attrdef function that walks through an in-memory $AttrDef table. The loop condition only checks the start of each entry, not the full 160-byte entry size. If the $AttrDef table is smaller than one entry, reading fields like ad->type can go past the allocated memory, causing a slab-out-of-bounds read. This happens when a volume's $AttrDef data size is too small, such as 120 bytes.

Detection Guidance

This vulnerability is specific to the Linux kernel's NTFS filesystem implementation. Detection requires checking the kernel version and NTFS code. Use uname -a to verify kernel version and grep for NTFS-related code in the kernel. Look for the ntfs_attr_find_in_attrdef function in the kernel source.

Impact Analysis

This vulnerability could allow an attacker to read or corrupt kernel memory by creating a specially crafted file on an NTFS volume. This might lead to system crashes, privilege escalation, or unauthorized data access. Systems using vulnerable Linux kernel versions with NTFS support are at risk.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it is a low-level memory corruption issue in the Linux kernel's NTFS filesystem driver. It may indirectly impact compliance if exploited to cause system instability or data corruption, potentially leading to unauthorized access or data loss. However, no evidence suggests this vulnerability specifically targets or facilitates violations of these regulations.

Mitigation Strategies

Apply the latest kernel security patches from your Linux distribution. If using a custom kernel, update to a version containing the fix. Avoid mounting untrusted NTFS volumes until patched. Monitor kernel security advisories for updates.

Hi! I’m here to help you understand CVE-2026-98136. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70