CVE Vulnerability Catalog

In the Linux kernel, the NTFS filesystem centralized $INDEX_ROOT header validation. A dedicated helper was added for stricter validation of $INDEX_ROOT and is used for both directory inodes and named index inodes. This keeps root size and header geometry checks consistent across both read paths.

In the Linux kernel, an ABBA deadlock in the NTFS filesystem was fixed, occurring during writeback of MFT records. The issue appeared after a change in base record lookup and could cause system hangs during xfstests generic/113. The fix removes extent_lock and mrec_lock acquisition from the MFT folio writeback path, eliminating the lock ordering conflict.

In the Linux kernel, the NTFS filesystem avoids heap allocation for free-cluster readahead state. get_nr_free_clusters() allocated a temporary file_ra_state before publishing the free cluster count, and if allocation failed, the worker returned without setting the flag or waking waiters, potentially causing indefinite blocking. Now the state is kept on the stack and passed by address, eliminating the allocation failure path.

In the Linux kernel, the NTFS filesystem now validates index entries on reading. Index entries are validated immediately after reading an index root or index block from disk, eliminating repeated checks in lookup and readdir and reducing the risk of missing checks in those paths.

In the Linux kernel, the NTFS filesystem detects mapping-pairs LCN accumulator overflow. The parser accumulates relative LCN deltas in a signed integer, and a corrupted attribute can drive the addition past the representable range. An overflow check is added before storing the next run.

In the Linux kernel, the NTFS filesystem now validates resident $INDEX_ROOT values on lookup. Resident $INDEX_ROOT values carry index header fields that callers consume after lookup. Validation of the header fields is added before returning the attribute, requiring 8-byte alignment, a sane entries_offset, index_length within allocated_size, allocated_size within the resident value, and enough entry space for at least an index entry header.

In the Linux kernel's NTFS filesystem, the attribute validator did not reject non-resident records for attributes that must be resident. This could lead to incorrect data reads and potential errors. The fix extends the existing check to all resident-only attribute types.

In the Linux kernel's NTFS3 filesystem, the DeleteIndexEntryAllocation function did not bound the memmove length, potentially leading to out-of-bounds access. The fix adds proper checks, including rejecting zero length.

In the Linux kernel's NTFS3 filesystem (fs/ntfs3), during log replay (log_replay) in the analysis pass, the copy_lcns function did not verify that write indices into the page_lcns[] array stay within bounds. A specially crafted log record (LRH) could cause an out-of-bounds write (slab-out-of-bounds), leading to memory corruption.

In the Linux kernel's NTFS3 filesystem, the UpdateResidentValue function did not validate the attribute offset, potentially leading to data size underflow and out-of-bounds read. The fix adds validation at the source.

In the Linux kernel's NTFS3 filesystem, the indx_find_buffer function had no recursion depth limit, potentially leading to kernel stack overflow. The fix adds a depth parameter and a check against the limit.

A vulnerability in the Linux kernel's ntfs3 driver allows an infinite loop during mount of a crafted NTFS disk image, hanging the mounting thread and triggering a soft-lockup panic. The issue is caused by an unbounded iteration in check_rstbl() while traversing the free-entry list of RESTART_TABLE. A crafted image with a cyclic free chain bypasses existing guards and causes a denial of service.

In the Linux kernel's NTFS3 filesystem, a vulnerability allows an out-of-bounds write when promoting a full resident $INDEX_ROOT to $INDEX_ALLOCATION. A crafted NTFS image can cause memcpy of attacker-controlled data past the allocated buffer, leading to heap corruption.

In the Linux kernel's NTFS3 filesystem, a vulnerability allows out-of-bounds write due to missing validation of the split-point offset in indx_insert_into_buffer. A crafted NTFS image causes an integer underflow and a near-4GiB memmove, corrupting memory and panicking the kernel.

In the Linux kernel's NTFS filesystem, the ntfs_rename function could cause a deadlock due to incorrect locking order of mrec_lock. The fix changes the locking order to avoid deadlock.

In the Linux kernel's NTFS filesystem, attribute list update during superblock teardown could cause a self-deadlock. The fix adds a check for superblock activity and returns an error if inactive.

In the Linux kernel's NTFS filesystem, ntfs_lookup_inode_by_name() returns MFT references read from directory index entries on disk, which are untrusted. The function can return an error-marked MFT reference without validation, causing callers to misinterpret the result. The fix normalizes all such references to ERR_MREF(-EIO) across all four return paths.

In the Linux kernel's NTFS filesystem, there is a self-deadlock issue during inode eviction. An attribute-list update can drop the last reference to a temporary attribute inode, leading to ntfs_drop_big_inode() being called for the base inode from within its own writeback path. If the base inode is unlinked, the function waits for folio writeback that the same worker is responsible for, causing an indefinite wait.

In the Linux kernel's NTFS filesystem, system files such as $Bitmap can be written from userspace, leading to volume corruption and writeback deadlock. The fix marks base metadata files as immutable during inode read so the VFS rejects write, mmap, truncate, and unlink with -EPERM.

In the Linux kernel's NTFS filesystem, ntfs_map_runlist_nolock() can encounter a resident attribute where a non-resident one is expected, previously triggering only a WARN_ON and leading to reading the wrong union member. The fix replaces the WARN_ON with an -EIO error return, causing crafted images to be rejected during mount.