CVE-2026-90048 Linux CVE debrief

Who should care

Linux kernel developers and maintainers, Linux distribution maintainers, and users of Linux systems that use the ntfs3 filesystem implementation should be aware of this vulnerability and take steps to verify patch application and monitor for suspicious activity.

Why it matters

A slab-out-of-bounds write vulnerability exists in the Linux kernel's ntfs3 filesystem implementation. This vulnerability can be triggered by a crafted, loop-mounted NTFS image and has been resolved with a patch.

• Verify patch application and kernel version
• Restrict access to NTFS filesystems
• Monitor for suspicious activity

Technical summary

The `ni_create_attr_list` function in the Linux kernel's ntfs3 filesystem implementation does not properly check the size of the buffer when adding attributes to a file. This can lead to a slab-out-of-bounds write vulnerability when a crafted, loop-mounted NTFS image is used. The patch addresses this issue by sizing the buffer from the actual attributes instead of assuming a single record size is always enough. This change prevents the slab-out-of-bounds write vulnerability by ensuring the buffer is large enough to hold all attributes.

Defensive priority

High

Recommended defensive actions

• Review and apply the patch to the Linux kernel's ntfs3 filesystem implementation
• Restrict access to NTFS filesystems to trusted sources
• Monitor for suspicious activity on NTFS filesystems
• Verify patch application and kernel version
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The vulnerability was discovered in the Linux kernel's ntfs3 filesystem implementation. A crafted, loop-mounted NTFS image can trigger the vulnerability. The patch sizes the buffer from the actual attributes instead of assuming a single record size is always enough. Defenders should verify patch application, kernel version, and monitor for suspicious activity on NTFS filesystems.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.