CVE-2026-90118 (GCVE-0-2026-90118)

Vulnerability from cvelistv5 – Published: 2026-09-17 16:06 – Updated: 2026-09-18 17:53
VLAI
Title
ntfs: fix off-by-one page overflow in ntfs_decompress()
Summary
In the Linux kernel, the following vulnerability has been resolved: ntfs: fix off-by-one page overflow in ntfs_decompress() The per-token range check in ntfs_decompress() uses if (cb >= cb_sb_end || dp_addr > dp_sb_end) break; so dp_addr == dp_sb_end falls through to the symbol copy `*dp_addr++ = *cb++`, writing one byte past the destination page. Since NTFS_SB_SIZE == PAGE_SIZE the destination is a single page, so the byte lands in the adjacent page, and *dest_ofs is left one past the sub-block end (the later `*dest_ofs &= ~PAGE_MASK` then yields 1, not 0, so the page is never finalized and later sub-blocks keep writing further past it). A corrupted compressed $DATA attribute thus produces a bounded run of out-of-bounds writes when the file is read. Break as soon as dp_addr reaches dp_sb_end; a full sub-block still completes, as its final copy advances dp_addr to exactly dp_sb_end.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 1e9ea7e04472d4e5e12e58c881eaacfb3e49b669 , < b42644e425fed4a5cd6c88372655da5c1b52c666 (git)
Affected: 1e9ea7e04472d4e5e12e58c881eaacfb3e49b669 , < 98716c9fce21f6c8a9d71e08cf53e7504fa562f4 (git)
guessed Create a notification for this product.
Linux Linux Affected: 7.1
Unaffected: 0 , < 7.1 (semver)
Unaffected: 7.2.6 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/ntfs/compress.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "b42644e425fed4a5cd6c88372655da5c1b52c666",
              "status": "affected",
              "version": "1e9ea7e04472d4e5e12e58c881eaacfb3e49b669",
              "versionType": "git"
            },
            {
              "lessThan": "98716c9fce21f6c8a9d71e08cf53e7504fa562f4",
              "status": "affected",
              "version": "1e9ea7e04472d4e5e12e58c881eaacfb3e49b669",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/ntfs/compress.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "7.1"
            },
            {
              "lessThan": "7.1",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.6",
                  "versionStartIncluding": "7.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "7.1",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nntfs: fix off-by-one page overflow in ntfs_decompress()\n\nThe per-token range check in ntfs_decompress() uses\n\n\tif (cb \u003e= cb_sb_end || dp_addr \u003e dp_sb_end)\n\t\tbreak;\n\nso dp_addr == dp_sb_end falls through to the symbol copy\n`*dp_addr++ = *cb++`, writing one byte past the destination page.  Since\nNTFS_SB_SIZE == PAGE_SIZE the destination is a single page, so the byte\nlands in the adjacent page, and *dest_ofs is left one past the sub-block\nend (the later `*dest_ofs \u0026= ~PAGE_MASK` then yields 1, not 0, so the page\nis never finalized and later sub-blocks keep writing further past it).  A\ncorrupted compressed $DATA attribute thus produces a bounded run of\nout-of-bounds writes when the file is read.\n\nBreak as soon as dp_addr reaches dp_sb_end; a full sub-block still\ncompletes, as its final copy advances dp_addr to exactly dp_sb_end."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The overflowing bytes are LZNT-style symbol tokens in a compressed unnamed $DATA attribute. They reach ntfs_decompress() only after ntfs_file_read_iter\u2192generic_file_read_iter\u2192ntfs_read_folio\u2192ntfs_read_compressed_block() copies those clusters from the block device; a remote client does not carry the token stream.\nAC:L - A crafted compressed $DATA that leaves dp_addr==dp_sb_end makes the per-token `dp_addr \u003e dp_sb_end` check fall through to `*dp_addr++ = *cb++`. Ending the sub-block so `*dest_ofs \u0026= ~PAGE_MASK` yields 1 is deterministic and does not depend on a race or uninfluenced layout.\nPR:N - The attacker only needs to supply the image that contains the malformed compressed $DATA; ntfs_fs_type has no FS_USERNS_MOUNT so mount_capable() needs init-namespace CAP_SYS_ADMIN, which is the victim\u0027s mount (UI:R), not an attacker privilege on the target.\nUI:R - The malformed tokens exist only on the attacker-supplied volume. ntfs_get_tree()\u2192get_tree_bdev()\u2192ntfs_fill_super() must mount that image before ntfs_file_read_iter can read the compressed file and enter ntfs_decompress().\nS:U - The write past kmap_local_page() of dest_pages[] corrupts the host kernel\u0027s adjacent page in the same OS security domain; it is not a VM, IOMMU, or sandbox boundary crossing.\nC:H - The off-by-one `*dp_addr++ = *cb++` plus later sub-blocks (dest_ofs left at 1, so the dest folio is never finalized) overwrite the physically adjacent kernel page, a memory-corruption primitive that can be leveraged for kernel information disclosure.\nI:H - Each overflowing symbol token writes an attacker-chosen byte from the compressed stream one past the destination page, and later sub-blocks keep writing further past it into the adjacent page, an out-of-bounds kernel write usable for control-flow hijack.\nA:H - Writing past the kmap_local_page() mapping of the dest folio into the next pfn can oops or panic the kernel on the ntfs_file_read_iter\u2192ntfs_decompress() path even when the overflow is not turned into a reliable write primitive."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-18T17:53:07.562Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/b42644e425fed4a5cd6c88372655da5c1b52c666"
        },
        {
          "url": "https://git.kernel.org/stable/c/98716c9fce21f6c8a9d71e08cf53e7504fa562f4"
        }
      ],
      "title": "ntfs: fix off-by-one page overflow in ntfs_decompress()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-90118",
    "datePublished": "2026-09-17T16:06:23.333Z",
    "dateReserved": "2026-09-11T19:38:34.787Z",
    "dateUpdated": "2026-09-18T17:53:07.562Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-90118",
      "date": "2026-09-25",
      "epss": "0.00174",
      "percentile": "0.06041"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "fs/ntfs/compress.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "b42644e425fed4a5cd6c88372655da5c1b52c666",
                    "status": "affected",
                    "version": "1e9ea7e04472d4e5e12e58c881eaacfb3e49b669",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "98716c9fce21f6c8a9d71e08cf53e7504fa562f4",
                    "status": "affected",
                    "version": "1e9ea7e04472d4e5e12e58c881eaacfb3e49b669",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "fs/ntfs/compress.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "7.1"
                  },
                  {
                    "lessThan": "7.1",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.2.*",
                    "status": "unaffected",
                    "version": "7.2.6",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.3-rc1",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nntfs: fix off-by-one page overflow in ntfs_decompress()\n\nThe per-token range check in ntfs_decompress() uses\n\n\tif (cb \u003e= cb_sb_end || dp_addr \u003e dp_sb_end)\n\t\tbreak;\n\nso dp_addr == dp_sb_end falls through to the symbol copy\n`*dp_addr++ = *cb++`, writing one byte past the destination page.  Since\nNTFS_SB_SIZE == PAGE_SIZE the destination is a single page, so the byte\nlands in the adjacent page, and *dest_ofs is left one past the sub-block\nend (the later `*dest_ofs \u0026= ~PAGE_MASK` then yields 1, not 0, so the page\nis never finalized and later sub-blocks keep writing further past it).  A\ncorrupted compressed $DATA attribute thus produces a bounded run of\nout-of-bounds writes when the file is read.\n\nBreak as soon as dp_addr reaches dp_sb_end; a full sub-block still\ncompletes, as its final copy advances dp_addr to exactly dp_sb_end."
          }
        ],
        "id": "CVE-2026-90118",
        "lastModified": "2026-09-18T18:17:42.627",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-09-17T17:17:03.963",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/98716c9fce21f6c8a9d71e08cf53e7504fa562f4"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/b42644e425fed4a5cd6c88372655da5c1b52c666"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.