« Volver al listado

CVE-2026-98136

Estado: En análisisSin puntuar—

In the Linux kernel, the following vulnerability has been resolved:

ntfs: bound $AttrDef table walk to the loaded table size

ntfs_attr_find_in_attrdef() walks the in-memory $AttrDef table, but the loop condition bounds only the start of each entry, not the whole entry:

struct attr_def is 160 bytes; the guard reads ad->type at offset 128 and the loop body reads further fields. vol->attrdef is kvzalloc(i_size), where i_size is the on-disk $AttrDef data size, checked in load_and_init_attrdef() only as 0 < i_size <= 0x7fffffff. A volume whose $AttrDef data size is smaller than one entry (e.g. 120 bytes) makes the read of ad->type run past the allocation. Creating a file reaches this through ntfs_attr_size_bounds_check() and reads out of bounds:

Leer descripción completaMostrar menos

Require the whole entry to lie within attrdef_size in the loop guard, and reject at mount a $AttrDef too small to hold one attr_def entry.

Detalles técnicos trazas, registros y código del informe original
	for (ad = vol->attrdef; (u8 *)ad - (u8 *)vol->attrdef <
			vol->attrdef_size && ad->type; ++ad)

  BUG: KASAN: slab-out-of-bounds in ntfs_attr_find_in_attrdef+0x66/0xa0
  Read of size 4 at addr ffff888005833280 by task init/1
   ntfs_attr_find_in_attrdef
   ntfs_attr_size_bounds_check
   ntfs_attr_can_be_non_resident
   ntfs_attr_add

CVSS

NVD no ha asignado puntuación CVSS a esta CVE (habitual desde el cambio de política de abril de 2026).

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Linux — Linux KernelAI

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-98136",
  "cveTags": [],
  "metrics": {},
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "1e9ea7e04472d4e5e12e58c881eaacfb3e49b669",
              "lessThan": "3e2ae47b8ebc632c27e7843a4632d9a7c060885e",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "1e9ea7e04472d4e5e12e58c881eaacfb3e49b669",
              "lessThan": "c8504fc1245f5322af5fa5c325ab05f9cf792b87",
              "versionType": "git"
            }
          ],
          "programFiles": [
            "fs/ntfs/attrib.c",
            "fs/ntfs/super.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "7.1"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "7.1",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "7.2.7",
              "versionType": "semver",
              "lessThanOrEqual": "7.2.*"
            },
            {
              "status": "unaffected",
              "version": "7.3-rc2",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "fs/ntfs/attrib.c",
            "fs/ntfs/super.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2026-09-25T11:17:45.043",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/3e2ae47b8ebc632c27e7843a4632d9a7c060885e",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/c8504fc1245f5322af5fa5c325ab05f9cf792b87",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Undergoing Analysis",
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nntfs: bound $AttrDef table walk to the loaded table size\n\nntfs_attr_find_in_attrdef() walks the in-memory $AttrDef table, but the\nloop condition bounds only the start of each entry, not the whole entry:\n\n\tfor (ad = vol->attrdef; (u8 *)ad - (u8 *)vol->attrdef <\n\t\t\tvol->attrdef_size && ad->type; ++ad)\n\nstruct attr_def is 160 bytes; the guard reads ad->type at offset 128 and\nthe loop body reads further fields. vol->attrdef is kvzalloc(i_size),\nwhere i_size is the on-disk $AttrDef data size, checked in\nload_and_init_attrdef() only as 0 < i_size <= 0x7fffffff. A volume whose\n$AttrDef data size is smaller than one entry (e.g. 120 bytes) makes the\nread of ad->type run past the allocation. Creating a file reaches this\nthrough ntfs_attr_size_bounds_check() and reads out of bounds:\n\n  BUG: KASAN: slab-out-of-bounds in ntfs_attr_find_in_attrdef+0x66/0xa0\n  Read of size 4 at addr ffff888005833280 by task init/1\n   ntfs_attr_find_in_attrdef\n   ntfs_attr_size_bounds_check\n   ntfs_attr_can_be_non_resident\n   ntfs_attr_add\n\nRequire the whole entry to lie within attrdef_size in the loop guard, and\nreject at mount a $AttrDef too small to hold one attr_def entry."
    }
  ],
  "lastModified": "2026-09-30T14:10:59.253",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}