CVE-2026-90117 (GCVE-0-2026-90117)

Vulnerability from cvelistv5 – Published: 2026-09-17 16:06 – Updated: 2026-09-17 16:06
VLAI
Title
ntfs: validate usa_ofs before preserving the update sequence number
Summary
In the Linux kernel, the following vulnerability has been resolved: ntfs: validate usa_ofs before preserving the update sequence number When ntfs_mft_record_alloc() reuses a free mft record it reads the old update sequence number straight from the on-disk record: usn = *(__le16 *)((u8 *)m + le16_to_cpu(m->usa_ofs)); Here m points into the raw $MFT page-cache folio, which still holds unvalidated, MST-protected bytes: the folio is read by a plain iomap_read_folio() and neither post_read_mst_fixup() nor ntfs_mft_record_check() has run on it (both work on private copies). m->usa_ofs is therefore an untrusted u16, and a corrupted record can put it past the end of the record so the two-byte read lands outside the folio. Reading such a record while creating a file gives, under KASAN: BUG: KASAN: use-after-free in ntfs_mft_record_alloc+... Read of size 2 at addr ... ntfs_mft_record_alloc -> __ntfs_create -> ntfs_create -> path_openat Only preserve the old update sequence number when usa_ofs is even and in range, mirroring the check ntfs_mft_record_check() already applies; otherwise leave usn zero, which the existing restore below skips.
Severity
No CVSS data available.
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 495e90fa334828d4119061e2726af51d0a0fb4ed , < ea5a3c30710710c1dc5e483d3313309ec2e868f7 (git)
Affected: 495e90fa334828d4119061e2726af51d0a0fb4ed , < 81684340963da2e898eabb8c1e274433d9375bc6 (git)
guessed Create a notification for this product.
Linux Linux Affected: 7.1
Unaffected: 0 , < 7.1 (semver)
Unaffected: 7.2.6 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/ntfs/mft.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "ea5a3c30710710c1dc5e483d3313309ec2e868f7",
              "status": "affected",
              "version": "495e90fa334828d4119061e2726af51d0a0fb4ed",
              "versionType": "git"
            },
            {
              "lessThan": "81684340963da2e898eabb8c1e274433d9375bc6",
              "status": "affected",
              "version": "495e90fa334828d4119061e2726af51d0a0fb4ed",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/ntfs/mft.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "7.1"
            },
            {
              "lessThan": "7.1",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.6",
                  "versionStartIncluding": "7.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "7.1",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nntfs: validate usa_ofs before preserving the update sequence number\n\nWhen ntfs_mft_record_alloc() reuses a free mft record it reads the old\nupdate sequence number straight from the on-disk record:\n\n     usn = *(__le16 *)((u8 *)m + le16_to_cpu(m-\u003eusa_ofs));\n\nHere m points into the raw $MFT page-cache folio, which still holds\nunvalidated, MST-protected bytes: the folio is read by a plain\niomap_read_folio() and neither post_read_mst_fixup() nor\nntfs_mft_record_check() has run on it (both work on private copies).\nm-\u003eusa_ofs is therefore an untrusted u16, and a corrupted record can put\nit past the end of the record so the two-byte read lands outside the\nfolio.  Reading such a record while creating a file gives, under KASAN:\n\n   BUG: KASAN: use-after-free in ntfs_mft_record_alloc+...\n   Read of size 2 at addr ...\n    ntfs_mft_record_alloc -\u003e __ntfs_create -\u003e ntfs_create -\u003e path_openat\n\nOnly preserve the old update sequence number when usa_ofs is even and in\nrange, mirroring the check ntfs_mft_record_check() already applies;\notherwise leave usn zero, which the existing restore below skips."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-17T16:06:22.705Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/ea5a3c30710710c1dc5e483d3313309ec2e868f7"
        },
        {
          "url": "https://git.kernel.org/stable/c/81684340963da2e898eabb8c1e274433d9375bc6"
        }
      ],
      "title": "ntfs: validate usa_ofs before preserving the update sequence number",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-90117",
    "datePublished": "2026-09-17T16:06:22.705Z",
    "dateReserved": "2026-09-11T19:38:34.787Z",
    "dateUpdated": "2026-09-17T16:06:22.705Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-90117",
      "date": "2026-09-25",
      "epss": "0.00198",
      "percentile": "0.08505"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "fs/ntfs/mft.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "ea5a3c30710710c1dc5e483d3313309ec2e868f7",
                    "status": "affected",
                    "version": "495e90fa334828d4119061e2726af51d0a0fb4ed",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "81684340963da2e898eabb8c1e274433d9375bc6",
                    "status": "affected",
                    "version": "495e90fa334828d4119061e2726af51d0a0fb4ed",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "fs/ntfs/mft.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "7.1"
                  },
                  {
                    "lessThan": "7.1",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.2.*",
                    "status": "unaffected",
                    "version": "7.2.6",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.3-rc1",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nntfs: validate usa_ofs before preserving the update sequence number\n\nWhen ntfs_mft_record_alloc() reuses a free mft record it reads the old\nupdate sequence number straight from the on-disk record:\n\n     usn = *(__le16 *)((u8 *)m + le16_to_cpu(m-\u003eusa_ofs));\n\nHere m points into the raw $MFT page-cache folio, which still holds\nunvalidated, MST-protected bytes: the folio is read by a plain\niomap_read_folio() and neither post_read_mst_fixup() nor\nntfs_mft_record_check() has run on it (both work on private copies).\nm-\u003eusa_ofs is therefore an untrusted u16, and a corrupted record can put\nit past the end of the record so the two-byte read lands outside the\nfolio.  Reading such a record while creating a file gives, under KASAN:\n\n   BUG: KASAN: use-after-free in ntfs_mft_record_alloc+...\n   Read of size 2 at addr ...\n    ntfs_mft_record_alloc -\u003e __ntfs_create -\u003e ntfs_create -\u003e path_openat\n\nOnly preserve the old update sequence number when usa_ofs is even and in\nrange, mirroring the check ntfs_mft_record_check() already applies;\notherwise leave usn zero, which the existing restore below skips."
          }
        ],
        "id": "CVE-2026-90117",
        "lastModified": "2026-09-17T17:17:03.857",
        "metrics": {},
        "published": "2026-09-17T17:17:03.857",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/81684340963da2e898eabb8c1e274433d9375bc6"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/ea5a3c30710710c1dc5e483d3313309ec2e868f7"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.