Heap Overflow in Linux Kernel NTFS3 Journal: Discovery and Coordinated Patch

On September 14, 2026, the Zero Day Initiative published advisory ZDI-26-696 documenting a vulnerability in the Linux kernel's NTFS3 driver. The flaw, tracked as CVE-2026-72196 with a CVSS score of 8.4 (HIGH), allows a local attacker with low-privileged code execution to run arbitrary code in the kernel context. The attack vector exploits NTFS3 journal replay during the mount of a malformed filesystem, a component triggered automatically when the kernel reconstructs the transactional state of a potentially hostile NTFS volume.

The Mechanism: How Journal Replay Becomes an Attack Vector

The NTFS3 driver, introduced into the Linux kernel to provide native support for Windows NTFS filesystems, manages the journal ($LogFile) to ensure transactional consistency. When an NTFS volume is mounted, the kernel replays pending log records to reconstruct the filesystem's dirty state. This path, executed in kernel mode, is implicitly trusted: it processes on-disk data structures without a user-space validator intermediary.

According to the official CVE record, the function find_dp() verifies that target_vcn falls within the range [dp->vcn, dp->vcn + dp->lcns_follow), ensuring only that the first cluster of the log record header is covered by the DIR_PAGE_ENTRY. However, the subsequent copy_lcns loop iterating over lrh->lcns_follow is not constrained by the size dp->lcns_follow of the dynamically allocated page_lcns[] array.

For a malformed log record header with target_vcn = dp->vcn + dp->lcns_follow - 1 and lrh->lcns_follow > 1, iterations with index i > 0 generate writes beyond the heap buffer boundaries. The CVE record documents reproduction under UML+KASAN on mainline 8d90b09e6741 as a "slab-out-of-bounds write of size 8" from log_replay+0x68d4 on the mount path.

From Memory Corruption to Kernel Code Execution

The controlled write of cluster pointers (each entry is 8 bytes) beyond the slab heap boundaries offers potential primitives for manipulating adjacent objects. In a Linux kernel with the slab allocator, overwriting metadata of the next object — function pointers, buffer lengths, or control structures — can translate into code execution in the privileged kernel context. The ZDI advisory states this impact directly: "arbitrary code on affected installations of Linux Kernel."

The attack vector is strictly local (AV:L in the CVSS:3.1 vector AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), but with minimized access conditions: no privileges required (PR:N), no user interaction (UI:N). An attacker with access to even an unprivileged account can prepare a malformed NTFS image, mount it — or induce the system to mount it — and trigger the vulnerable path.

"This vulnerability allows local attackers to execute arbitrary code on affected installations of Linux Kernel. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability." — Advisory ZDI-26-696

A Recurring Pattern: The Second NTFS3 Journal Flaw in Four Months

The patch fixing CVE-2026-72196 is explicitly complementary to a prior change by Pavitra Jha, dated May 2, 2026, which addressed a different path in the version-0 dirty-page-table conversion. This sequence — two vulnerabilities in the same log replay subsystem within roughly four months — suggests a systematically underestimated attack surface in the NTFS3 driver's design.

The fix commit, 29 additions and 17 deletions in fs/ntfs3/fslog.c, introduces the missing check: j + lrh->lcns_follow <= dp->lcns_follow. The simplicity of the correction underscores the depth of the original oversight: a single missing bounds check in the copy loop, with consequences piercing every layer of kernel security up to arbitrary execution.

The time between vendor notification (May 7, 2026) and coordinated release (September 14, 2026) is approximately four months. This window, standard for ZDI's coordinated disclosure process, left installations exposed throughout the summer without a public advisory.

What to Do Now

• Verify that the kernel in use includes commit 5e7b598660cfa8e5af172cf4c65cffc126333307 or an equivalent backport in your distribution's stable releases.
• Restrict automatic mounting of NTFS volumes from untrusted sources, particularly on multi-user systems where low-privileged accounts can prepare malformed filesystems.
• Ensure fstab or automount policies do not permit NTFS mounts without administrative intervention on shared workstations or servers accessible to unprivileged users.
• Monitor distribution changelogs for inclusion of CVE-2026-72196 in upcoming security releases, as the CVE record indicates fixes in multiple versions without listing them explicitly.

Why Filesystem Drivers Remain a Critical Perimeter

The NTFS3 driver's history reprises a consolidated pattern in kernel security: filesystem format parsers, running in privileged mode on untrusted data from removable devices or arbitrary images, constitute a fragile architectural boundary. The principle of least privilege does not apply to kernel code, which by definition operates above all user-space isolation.

The dual flaw in journal replay — May and September 2026 — indicates that the NTFS3 transactional recovery code path has not received the same hardening attention as normal I/O paths. For administrators and distributors, the message is pragmatic: NTFS support on Linux is functionally mature, but its kernel-level attack surface demands treatment on par with any other system-critical security component.

The identity of the researcher who discovered the vulnerability does not appear in the ZDI advisory. No infrastructure overlaps linking this discovery to other campaigns or known actors are documented. The dossier does not specify the presence of in-the-wild exploits or the distribution of malicious NTFS images in real-world scenarios.

Sources

• http://www.zerodayinitiative.com/advisories/ZDI-26-696/
• https://www.cve.org/CVERecord?id=CVE-2026-72196
• http://www.zerodayinitiative.com/advisories/upcoming/
• https://github.com/torvalds/linux/commit/5e7b598660cfa8e5af172cf4c65cffc126333307
• https://www.trendmicro.com/

Information verified against cited sources and current as of publication.

Sources