CVE-2026-90199

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

fs/ntfs3: reject out-of-range evcn in mi_enum_attr()

In mi_enum_attr(), the start/end VCN validation for non-resident

attributes is:

if (svcn > evcn + 1) goto out;

When evcn is U64_MAX the "evcn + 1" expression wraps to 0 and any svcn

passes the check. For evcn values close to U64_MAX (but not equal to it)

the right-hand side is still a meaningless near-wrap upper bound, so a

malformed on-disk attribute with svcn == 0 and evcn near U64_MAX can pass

mi_enum_attr() unrejected.

VCN (virtual cluster number) is a cluster index, so any valid evcn is

bounded by the volume's total cluster count, which ntfs3 holds in

sbi->used.bitmap.nbits (set up in ntfs_init_from_boot() before any caller

of mi_enum_attr() runs). Reject evcn values that fall outside this range.

However, an empty non-resident attribute (no allocated clusters) is

legitimately encoded with svcn == 0 and evcn == -1 (U64_MAX), e.g. via

attr->nres.evcn = cpu_

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References