CVE-2026-31716: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-31716 is an out-of-bounds write vulnerability in the Linux kernel's NTFS3 filesystem driver, specifically in the journal-replay code path. The flaw arises because check_file_record() validates rec->total against the record size but never validates rec->used, allowing integer underflow in memmove length calculations during journal replay actions (DeleteAttribute, CreateAttribute, change_attr_size). Affected kernel versions include 5.15 through 6.6.135, 6.7 through 6.12.83, 6.13 through 6.18.24, and 6.19 through 7.0.1. It was published on May 1, 2026, and carries a CVSS v3.1 base score of 7.8 (High) (Red Hat CVE, Feedly).

The root cause is classified as CWE-787 (Out-of-bounds Write). The do_action() journal-replay handler reads rec->used from disk and uses it without bounds validation to compute memmove lengths: for example, DeleteAttribute computes used - asize - roff, CreateAttribute computes used - roff, and change_attr_size computes used - PtrOffset(rec, next). If rec->used is smaller than an attribute offset or larger than the record size, these subtractions underflow, causing the kernel to copy arbitrarily large amounts of memory into a 4 KB buffer. The fix bounds rec->used correctly in check_file_record(), analogous to commit b2bc7c44ed17 which addressed a related slab-out-of-bounds read in DeleteIndexEntryRoot (Red Hat CVE, Feedly). Exploitation requires local access and user interaction (e.g., mounting a crafted NTFS filesystem image).

Successful exploitation allows a local attacker who can mount a corrupted or specially crafted NTFS filesystem to trigger kernel-level out-of-bounds memory writes, potentially leading to kernel code execution, privilege escalation, or denial of service (system crash). All three security dimensions are affected: confidentiality (kernel memory disclosure), integrity (arbitrary kernel memory modification), and availability (kernel panic/crash). The scope is limited to the local system, but kernel code execution could enable full system compromise (Feedly, Red Hat CVE).

No public proof-of-concept exploit or evidence of in-the-wild exploitation has been observed as of the time of writing (Feedly). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS score is approximately 0.018% (0.000180), indicating a very low probability of exploitation in the near term. Exploitation requires local access and the ability to mount an untrusted NTFS filesystem, which limits the practical attack surface (Red Hat CVE).

1. Prepare a malicious NTFS image: Craft a specially constructed NTFS filesystem image where the file record's rec->used field is set to a value either smaller than a validated attribute offset or larger than the record size, causing integer underflow in memmove length calculations during journal replay.
2. Deliver the image to the target: Transfer the crafted NTFS image to a system running a vulnerable Linux kernel (5.15–6.6.135, 6.7–6.12.83, 6.13–6.18.24, or 6.19–7.0.1) via physical media, network share, or social engineering.
3. Trigger filesystem mount: Induce the target user (or use a local account with mount privileges) to mount the crafted NTFS image, e.g., via mount -t ntfs3 malicious.img /mnt/target or by exploiting automount functionality.
4. Trigger journal replay: Ensure the crafted filesystem has a dirty journal, so the kernel's NTFS3 driver invokes do_action() during mount to replay journal entries, triggering the vulnerable memmove with an underflowed length.
5. Achieve kernel memory corruption: The out-of-bounds write corrupts kernel memory, potentially enabling privilege escalation to root or causing a kernel panic, depending on what memory is overwritten (Feedly, Red Hat CVE).

• Logs: Kernel logs (dmesg / /var/log/kern.log) showing NTFS3-related errors, slab-out-of-bounds warnings, or kernel BUG/OOPS traces during filesystem mount or journal replay operations.
• Process: Unexpected mount or ntfs3 kernel module activity initiated by unprivileged users; automount daemons processing untrusted NTFS images.
• File System: Presence of externally supplied or unusual NTFS image files (.img, .iso, .vhd) in user-accessible directories, particularly those with dirty journal flags.
• System: Sudden kernel panics or system reboots coinciding with NTFS filesystem mount events on systems running vulnerable kernel versions.

Update to a patched Linux kernel version: 6.6.136 or later, 6.12.84 or later, 6.18.25 or later, or 7.0.2 or later (patches also included in 7.1-rc1) (Red Hat CVE, Feedly). As a workaround, restrict the ability of unprivileged users to mount NTFS filesystems (e.g., via nosuid/nodev policies, removing ntfs3 module, or enforcing mandatory access controls such as SELinux/AppArmor). Avoid mounting untrusted or externally sourced NTFS filesystem images on production systems until patched. Amazon Linux 2023 users should apply ALAS2023-2026-1816 (AWS Advisory).

Red Hat has acknowledged the vulnerability and published a CVE advisory page (Red Hat CVE). The Yocto Project security mailing list has discussed the issue across multiple messages, indicating downstream embedded Linux ecosystem awareness (Yocto Security). openSUSE has also issued a security announcement (openSUSE Advisory). No significant social media controversy or high-profile researcher commentary has been observed beyond routine CVE tracking.