CVE-2026-98136

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ntfs: bound $AttrDef table walk to the loaded table size

ntfs_attr_find_in_attrdef() walks the in-memory $AttrDef table, but the

loop condition bounds only the start of each entry, not the whole entry:

for (ad = vol->attrdef; (u8 *)ad - (u8 *)vol->attrdef <

vol->attrdef_size && ad->type; ++ad)

struct attr_def is 160 bytes; the guard reads ad->type at offset 128 and

the loop body reads further fields. vol->attrdef is kvzalloc(i_size),

where i_size is the on-disk $AttrDef data size, checked in

load_and_init_attrdef() only as 0 < i_size <= 0x7fffffff. A volume whose

$AttrDef data size is smaller than one entry (e.g. 120 bytes) makes the

read of ad->type run past the allocation. Creating a file reaches this

through ntfs_attr_size_bounds_check() and reads out of bounds:

BUG: KASAN: slab-out-of-bounds in ntfs_attr_find_in_attrdef+0x66/0xa0

Read of size 4 at addr ffff888005833280 by task init/1

ntfs_attr_find_

/// Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// Affected products

/// References