CVE-2026-90117

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ntfs: validate usa_ofs before preserving the update sequence number

When ntfs_mft_record_alloc() reuses a free mft record it reads the old

update sequence number straight from the on-disk record:

usn = *(__le16 *)((u8 *)m + le16_to_cpu(m->usa_ofs));

Here m points into the raw $MFT page-cache folio, which still holds

unvalidated, MST-protected bytes: the folio is read by a plain

iomap_read_folio() and neither post_read_mst_fixup() nor

ntfs_mft_record_check() has run on it (both work on private copies).

m->usa_ofs is therefore an untrusted u16, and a corrupted record can put

it past the end of the record so the two-byte read lands outside the

folio. Reading such a record while creating a file gives, under KASAN:

BUG: KASAN: use-after-free in ntfs_mft_record_alloc+...

Read of size 2 at addr ...

ntfs_mft_record_alloc -> __ntfs_create -> ntfs_create -> path_openat

Only preserve the old update sequence

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References