Linux kernel (ntfs3) vulnerabilities

In the Linux kernel, ni_create_attr_list() in the ntfs3 filesystem has a slab-out-of-bounds write. The function allocates a fixed buffer of record_size bytes and writes one ATTR_LIST_ENTRY per attribute without checking the buffer end. A crafted NTFS image with many minimum-size nameless attributes can overflow the heap buffer.

A use-after-free vulnerability exists in the Linux kernel's ntfs3 module. When the "nocase" mount option is used, dentry compare and hash functions access superblock private data in the RCU pathwalk, while ntfs_put_super() and ntfs3_kill_sb() free that data without an RCU delay. A lookup still inside the filesystem when the last mount reference is dropped causes a UAF.

In the Linux kernel's ntfs3 filesystem, ntfs_create_inode() called d_instantiate() before unlock_new_inode(), causing a race between directory creation and mounting a filesystem on the same path. This reset the i_rwsem lock state (count and owner) while another thread already held it, triggering warnings in do_new_mount and potentially causing inode_lock() to hang indefinitely. The fix switches to d_instantiate_new() and removes the trailing unlock_new_inode().

In the Linux kernel, the ntfs3 filesystem lacks synchronization between write operations and ioctl calls that clear the file's compression flag. If a user clears the compression flag during a write, the kernel selects incorrect operations and triggers a NULL pointer dereference, causing a kernel oops.