CVE-2026-90048

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

fs/ntfs3: fix slab-out-of-bounds write in ni_create_attr_list()

ni_create_attr_list() allocates a fixed buffer of al_aligned(record_size)

(== record_size) bytes and then walks every attribute of the primary MFT

record, writing one ATTR_LIST_ENTRY per attribute and advancing the cursor

by le_size(name_len), with no check against the end of the buffer; the

total size is only computed after the loop.

A minimum-size resident attribute occupies SIZEOF_RESIDENT (0x18 = 24)

bytes on disk, but an unnamed attribute expands to le_size(0) (0x20 = 32)

bytes in the list. Because the number of attributes in a record is not

bounded (mi_enum_attr() accepts arbitrarily many equal-type, nameless

minimum-size attributes), a crafted record packed with such attributes

produces a list larger than record_size and overflows the heap buffer.

This is reachable from a crafted, loop-mounted NTFS image: opening the file

and adding an attribut

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References