Heap Buffer Overflow in Linux Kernel ntfs3 Filesystem Implementation

CVE-2026-90048

What is CVE-2026-90048?

A vulnerability exists in the ntfs3 filesystem implementation of the Linux kernel that could lead to a heap buffer overflow. This flaw occurs in the ni_create_attr_list() function, which allocates a buffer of a fixed size to store attribute entries from the primary Master File Table (MFT). However, the function doesn’t adequately check that the number of attributes being processed does not exceed the buffer size, which can lead to an overflow when crafted NTFS images with multiple unnamed attributes are handled. Successfully exploiting this vulnerability could allow an attacker to introduce crafted NTFS images that cause the kernel to write beyond the allocated memory space, potentially leading to system crashes or arbitrary code execution.

References