Look up another CVE · open CVE-2026-90133 in the interactive tracker

CVE-2026-90133

ntfs: Fix index_root heap OOB write in ntfs_ir_to_ib()

7.8 EPSS 0.2% AV:L

Published 2026-09-17 (31 days ago) by the Linux kernel CNA. Subsystem fs/ntfs. Debian urgency: unimportant.

What to do, per Debian release

Debian's own status for CVE-2026-90133 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source

Release	Status	Version	What this means
Debian 12bookworm	not affected	6.1.190-1	Nothing to do. bookworm never shipped the vulnerable code.
Debian 13trixie	not affected	6.12.113-1	Nothing to do. trixie never shipped the vulnerable code.
Debian 14forky	fixed	7.2.6-1	Update the kernel and reboot. Fixed in 7.2.6-1. A running kernel keeps the old code until the machine restarts.
Debian unstablesid	fixed	7.2.6-1	Update the kernel and reboot. Fixed in 7.2.6-1. A running kernel keeps the old code until the machine restarts.

The vulnerability

What the bug is

ntfs_ir_to_ib copies all entries from index_root into a freshly allocated index_block_size-byte buffer without verifying that the entries fit in the available space. The entries in index_root may be larger than the usable entry space in the index block. This can cause OOB writes past the end of the allocation. The validator ntfs_index_root_inconsistent() checks that entries are self-consistent within the IR value, but never cross-checks them against index_block_size. There is no bounds check in ntfs_ir_to_ib() before the memcpy. Fixing this at the sink in ntfs_ir_to_ib() since ntfs_index_root_inconsistent() validates the logical consistency of index_root as a structure and a root with large entries is a structurally valid root. The bug is a size conflict of ntfs_ir_to_ib(). Also, the validator is called once per inode load in ntfs_read_locked_inode() while ntfs_ir_to_ib() is only called during a reparent, a check there adds no overhead to the common path. Moreover, even a future call path that bypasses the validator would still be protected. With NULL as first parameter of ntfs_error(), the volume error flag is never set by this call, so the device name will be absent from the error message. In any case, that the caller, ntfs_ir_reparent(), prints an error message that includes the device name on NULL returns. I think this is the best solution available without adding 'struct super_block *sb' as a parameter to ntfs_ir_to_ib(). This heap out-of-bounds write is triggered by a crafted filesystem image, which is not in the kernel threat model, anyway, fixing memory errors would be nice to keep things secure.

Where it lives

The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.

fs/ntfs/index.c

What this is: NTFS FILESYSTEMMAINTAINERS section matched on fs/ntfs/ · linux-fsdevel@vger.kernel.org · Maintained
Kernel module: ntfs

Check it on the machine

grep -w CONFIG_NTFS_FS /boot/config-$(uname -r)

Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.

lsmod | grep -w ntfs

Prints a line if that module is loaded right now, and nothing if it is not. One that is not loaded can still be loaded later by anything that needs it.

Show whether Debian builds this, per release

Debian does not build this code in 1 release. It does build it in 2 releases, so the answer depends on which release the machine runs. The build rule could not be established for 1 release, so nothing is claimed about those.

bookwormn
trixie?
forky, sidm

n: not enabled on any flavour - this release does not build the code
?: not established - no Makefile entry for the affected file
m: a loadable module on every flavour - check lsmod, can be blacklisted

Where a release above reads "not established", no build rule for the affected file was found in that release's kernel tree. That is a gap in this lookup, not a finding that the code is absent.

Build switch: CONFIG_NTFS_FS

From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages

Debian tracker CVE record NVD kernel CNA record

Signals

Published: 2026-09-17 (31 days ago)source
CVSS: 7.8 high
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:Hsource recompute it
Attack vector: local (AV:L)source
EPSS: 0.21%, higher than 9.8% of all CVEssource
CISA KEV: not listedthe KEV catalogue
Debian urgency: unimportantsource
Subsystem: fs/ntfs

Upstream fixes

The versions the CNA records as introducing and fixing this, and the commit for each. source

Introduced	Fixed in	Commit
7.1	7.2.6	825dec512093
7.1	7.3	dc09bf79b76f

Why the CNA scored it this way

Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source

AV:LAttack vector, local: The overflow source is on-disk $INDEX_ROOT (ir->index_block_size and the resident entries) that ntfs_ir_to_ib() memcpy()s; the trigger is vfs_create/mkdir/link/rename → ntfs_create/__ntfs_link → ntfs_index_add_filename → ntfs_ie_add → ntfs_ir_make_space → ntfs_ir_reparent. No protocol message carries those fields.
AC:LAttack complexity, low: ntfs_read_locked_inode() accepts any power-of-two index_block_size in [512, PAGE_SIZE] and ntfs_index_root_inconsistent() never compares entry bytes to that size, so a 512-byte IB plus a packed resident INDEX_ROOT in a full MFT record makes ntfs_ir_truncate() return -ENOSPC and ntfs_ir_reparent() run on the next create, with no race.
PR:NPrivileges required, none: mount_capable() needs init-namespace CAP_SYS_ADMIN because ntfs_fs_type lacks FS_USERNS_MOUNT; that mount is the victim or udisks2/vold action (UI:R), not attacker privilege. After mount, ntfs_create() is an ordinary VFS create on a directory whose mode the image controls, so the attacker needs no account.
UI:RUser interaction, required: ntfs_ir_to_ib() is called only from ntfs_ir_reparent(), not from ntfs_fill_super(), so attaching the volume is not enough. A victim or automounter must mount the attacker-supplied NTFS image, and then create/mkdir/link/rename must add a filename so ntfs_ie_add() takes the ENOSPC reparent path.
S:UScope, unchanged: The kvzalloc(index_block) overflow in ntfs_ir_to_ib() corrupts host-kernel heap in the same OS authority as fs/ntfs; it is in-kernel memory corruption, not a VM escape, IOMMU bypass, or sandbox breakout.
C:HConfidentiality impact, high: memcpy() in ntfs_ir_to_ib() writes attacker-controlled INDEX_ROOT entry bytes (UTF-16 names, MFT refs) past the kvzalloc(ir->index_block_size) object into adjacent slab, a heap OOB write that can be groomed to disclose neighboring kernel objects.
I:HIntegrity impact, high: The same memcpy is an unbounded heap out-of-bounds write of attacker-chosen index-entry contents past the allocated index_block, which can corrupt adjacent slab objects and hijack kernel control flow.
A:HAvailability impact, high: Writing past the kvzalloc index_block into unmapped or poisoned adjacent heap oopses or panics on the ntfs_ir_reparent() create/mkdir path, fully denying availability even when the overflow is not turned into a write primitive.