CVE-2026-90048: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-90048 is a heap buffer overflow (slab-out-of-bounds write) vulnerability in the Linux kernel's NTFS3 filesystem driver, specifically in the ni_create_attr_list() function. It affects Linux kernel versions from 5.15 up to (but not including) the patched stable releases: 6.6.157, 6.12.110, 6.18.51, 7.2.5, and 7.3-rc1. The vulnerability was disclosed on September 16, 2026, with patches available the same day. It carries a CVSS v3.1 base score of 9.8 (Critical) (Github Advisory).

The root cause is a missing bounds check (CWE class: heap buffer overflow) in ni_create_attr_list(), which allocates a fixed buffer of al_aligned(record_size) bytes and then iterates over every attribute in the primary MFT record, writing one ATTR_LIST_ENTRY per attribute without verifying the cursor position against the buffer end. The discrepancy between on-disk attribute size (SIZEOF_RESIDENT = 0x18 = 24 bytes) and in-list expansion size (le_size(0) = 0x20 = 32 bytes for unnamed attributes) means a crafted MFT record packed with minimum-size unnamed attributes can produce an attribute list larger than the allocated buffer. Exploitation is triggered by mounting a crafted NTFS image and performing an attribute-adding operation (e.g., setxattr), which drives the call chain: ntfs_set_ea() → ni_insert_resident() → ni_insert_attr() → ni_ins_attr_ext() → ni_create_attr_list(), resulting in a KASAN-detected slab-out-of-bounds write (Github Advisory).

Successful exploitation allows an attacker with the ability to mount a crafted NTFS image to corrupt kernel heap memory, potentially achieving arbitrary code execution in kernel context. This can result in full system compromise, including loss of confidentiality (access to all kernel and user data), integrity (arbitrary kernel memory writes), and availability (kernel crash or denial of service). Because the vulnerability operates at the kernel level, a successful exploit bypasses all user-space security boundaries and could enable privilege escalation or persistent backdoor installation (Github Advisory).

As of the disclosure date (September 16, 2026), there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation. No threat actor attribution has been reported, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires the ability to mount a crafted NTFS image (e.g., via loop-mount), which typically implies local access or control over a system that auto-mounts user-supplied images (Github Advisory).

1. Craft a malicious NTFS image: Create an NTFS filesystem image containing an MFT record packed with the maximum number of minimum-size, unnamed, equal-type resident attributes. Each attribute occupies 24 bytes on disk but expands to 32 bytes in the attribute list, causing the list to exceed the allocated buffer.
2. Mount the image: Use loop-mount to attach the crafted image to a target Linux system running a vulnerable kernel (5.15 ≤ version < patched stable): losetup /dev/loop0 crafted.img && mount -t ntfs3 /dev/loop0 /mnt/target.
3. Trigger the overflow: Open a file within the mounted NTFS filesystem and invoke setxattr (or equivalent) to add an extended attribute, triggering the call chain ntfs_set_ea() → ni_insert_resident() → ni_insert_attr() → ni_ins_attr_ext() → ni_create_attr_list().
4. Achieve heap corruption: The out-of-bounds write corrupts adjacent kernel heap objects (e.g., kmalloc-1k slab), potentially overwriting function pointers or other security-critical structures to gain arbitrary kernel code execution (Github Advisory).

• Logs: Kernel logs (dmesg) showing BUG: KASAN: slab-out-of-bounds errors referencing ni_create_attr_list, ni_ins_attr_ext, ni_insert_attr, or ni_insert_resident; stack traces involving ntfs_set_ea or ntfs_setxattr.
• Process: Unexpected processes (e.g., setfattr, xattr-related tools) operating on NTFS-mounted filesystems, particularly if initiated by unprivileged users.
• File System: Presence of unusual or externally supplied NTFS image files (.img, .ntfs) in user-accessible directories; loop devices (/dev/loop*) mounted with NTFS3 filesystems from untrusted sources.
• Network: In containerized or cloud environments, unexpected mounts of external block devices or image files that could indicate an attempt to introduce a crafted NTFS image.

Apply the available kernel patches, which fix the issue by sizing the attribute list buffer based on actual attribute counts rather than assuming record_size is always sufficient. Patched versions include Linux kernel 6.6.157, 6.12.110, 6.18.51, 7.2.5, and 7.3-rc1 (commit references: 7e9aee7e, fa2215cf, d07e281f, a84f3db7, 7c4841e2). As interim workarounds: disable the NTFS3 kernel module if not required (modprobe -r ntfs3), restrict mount privileges to trusted administrators, and avoid auto-mounting user-supplied or untrusted NTFS images (Github Advisory).