{"id":24736,"date":"2026-09-16T20:32:42","date_gmt":"2026-09-16T12:32:42","guid":{"rendered":"https:\/\/www.54iter.cn\/?vuln=cve-2026-90048"},"modified":"2026-09-16T20:32:42","modified_gmt":"2026-09-16T12:32:42","slug":"cve-2026-90048","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-90048","title":{"rendered":"CVE-2026-90048 &#8211; In the Linux kernel, the following vulnerability has been resolved:\n\nfs\/ntfs3: fix slab-ou"},"content":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>fs\/ntfs3: fix slab-out-of-bounds write in ni_create_attr_list()<\/p>\n<p>ni_create_attr_list() allocates a fixed buffer of al_aligned(record_size)<br \/>\n(== record_size) bytes and then walks every attribute of the primary MFT<br \/>\nrecord, writing one ATTR_LIST_ENTRY per attribute and advancing the cursor<br \/>\nby le_size(name_len), with no check against the end of the buffer; the<br \/>\ntotal size is only computed after the loop.<\/p>\n<p>A minimum-size resident attribute occupies SIZEOF_RESIDENT (0x18 = 24)<br \/>\nbytes on disk, but an unnamed attribute expands to le_size(0) (0x20 = 32)<br \/>\nbytes in the list.  Because the number of attributes in a record is not<br \/>\nbounded (mi_enum_attr() accepts arbitrarily many equal-type, nameless<br \/>\nminimum-size attributes), a crafted record packed with such attributes<br \/>\nproduces a list larger than record_size and overflows the heap buffer.<\/p>\n<p>This is reachable from a crafted, loop-mounted NTFS image: opening the file<br \/>\nand adding an attribute (e.g. via setxattr) drives ntfs_set_ea() -&gt;<br \/>\nni_insert_resident() -&gt; ni_insert_attr() -&gt; ni_ins_attr_ext() -&gt;<br \/>\nni_create_attr_list().<\/p>\n<p>  BUG: KASAN: slab-out-of-bounds in ni_create_attr_list+0xc48\/0x1058<br \/>\n  Write of size 4 at addr ffff000008984c00 by task setfattr\/345<br \/>\n   ni_create_attr_list+0xc48\/0x1058<br \/>\n   ni_ins_attr_ext+0x510\/0x7c0<br \/>\n   ni_insert_attr+0x3f8\/0x70c<br \/>\n   ni_insert_resident+0xc8\/0x3b0<br \/>\n   ntfs_set_ea+0x66c\/0xd28<br \/>\n   ntfs_setxattr+0x4d8\/0x5b0<br \/>\n   __arm64_sys_setxattr+0xa4\/0x124<br \/>\n  Allocated by task 345:<br \/>\n   ni_create_attr_list+0x188\/0x1058<br \/>\n  The buggy address belongs to the cache kmalloc-1k of size 1024<br \/>\n  (the write lands at object+1024).<\/p>\n<p>Size the buffer from the actual attributes instead of assuming a single<br \/>\nrecord_size is always enough.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>fs\/ntfs3: fix slab-out-of-bounds write in ni_create_attr_list()<\/p>\n<p>ni_create_attr_list() allocates a fixed buffer of al_aligned(recor<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-24736","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/24736","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=24736"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=24736"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=24736"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}