Skip to content
CVE PROGRAM SOURCE RECORDUnscored

CVE-2026-99171

ntfs3: free the sbi after a grace period

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Linux

Description

In the Linux kernel, the following vulnerability has been resolved: ntfs3: free the sbi after a grace period If the "nocase" mount option ntfs3 uses custom hash and dentry compare functions. Both access ntfs3 superblock private information in rcu pathwalk. ntfs_put_super() and ntfs3_kill_sb() drop the info without any rcu delay. A lookup that's still inside the filesystem when the last reference to the mount is dropped causes a UAF. With a pathwalk held up in ntfs_d_hash() while the last reference to the mount goes away: BUG: KASAN: slab-use-after-free in ntfs_nls_to_utf16+0x752/0x940 Read of size 8 at addr ff1100010453c850 by task walker/99 Call Trace: <TASK> ntfs_nls_to_utf16+0x752/0x940 ntfs_d_hash+0x22b/0x500 link_path_walk+0x11ad/0x1d30 path_lookupat+0x63/0xb00 filename_lookup+0x1f1/0x5b0 vfs_statx+0xd7/0x3b0 [...] Allocated by task 95: __kmalloc_cache_noprof+0x249/0x560 ntfs_init_fs_context+0x2db/0x5a0 alloc_fs_context+0x52e/0xc70 [...] Freed by task 98: kfree+0x1db/0x5b0 deactivate_locked_super+0x9c/0xf0 cleanup_mnt+0x9f/0x130 task_work_run+0x131/0x250 The bug is currently masked by the grace period in namespace_unlock() for umount(2). Keep the necessary information until the filesystem private info is freed and free it with an rcu delay. ntfs3_free_sbi() now runs from an rcu callback and drops the upcase table via ntfs_put_shared(). So switch s_shared_lock over to spin_lock_bh(). Otherwise the callback can deadlock against a task holding the lock on the same cpu.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Linux Linux

Default version status: unaffected

  • a3a956c78efaa202b1d75190136671cf6e87bfbe to < c39150784a801dbbfaf4fbfa284cb610552a5039affected
  • a3a956c78efaa202b1d75190136671cf6e87bfbe to < 36e6753daf9bb64563dcb5a3bb22f7699d973fa2affected
  • a3a956c78efaa202b1d75190136671cf6e87bfbe to < c8b1a4840467930e01f1a9374d991d7a8a2896c1affected
  • a3a956c78efaa202b1d75190136671cf6e87bfbe to < 7abecef26a9be8f9de70659a3092250461a52072affected
  • a3a956c78efaa202b1d75190136671cf6e87bfbe to < c01b091b06412d3b1b53d8c2925f6de586c8a2fcaffected

Linux Linux

Default version status: affected

  • 6.2affected
  • 0 to < 6.2unaffected
  • 6.6.161 to ≤ 6.6.*unaffected
  • 6.12.115 to ≤ 6.12.*unaffected
  • 6.18.59 to ≤ 6.18.*unaffected
  • 7.2.13 to ≤ 7.2.*unaffected
  • 7.3 to ≤ *unaffected

References