CVE-2026-90048

CVE-2026-90048 is a slab-out-of-bounds (heap) write in ni_create_attr_list() in the Linux kernel's NTFS3 filesystem driver: the attribute-list buffer is allocated at the fixed MFT record size, but a record packed with many minimal-size resident attributes generates an attribute list larger than that buffer, and the code advances its write cursor without any bounds check (the total size is only computed after the loop). It is triggered from a crafted, loop-mounted NTFS image - opening a file and adding an attribute (e.g., via setxattr) drives ntfs_set_ea() -> ni_insert_resident() -> ni_insert_attr() -> ni_ins_attr_ext() -> ni_create_attr_list(), with KASAN reporting a 4-byte write landing just past the end of a 1024-byte kmalloc-1k object. An attacker who can get a crafted image mounted gains kernel heap memory corruption, which typically enables local privilege escalation or a kernel crash (denial of service); despite the network-vector CVSS of 9.8, the practical trigger requires locally mounting untrusted NTFS media. Any Linux system with the NTFS3 driver enabled is affected, most notably desktops and multi-user servers where unprivileged users can mount removable drives or disk images. No public proof-of-concept, no CISA KEV listing, and no confirmed in-the-wild exploitation are known at this time.

What to do: Update affected systems to a kernel that includes the upstream fs/ntfs3 fix that sizes the attribute-list buffer from the actual attributes (fixed-release version numbers were not available in the data - track your distro's kernel security updates). Until patched, avoid mounting untrusted NTFS images or removable media, restrict unprivileged loop mounting and use of setxattr on NTFS volumes, and blacklist/unload the ntfs3 module if NTFS support is not needed. Check your kernel config for CONFIG_NTFS3_FS/ntfs3 to determine exposure.