CVE-2026-90048

In the Linux kernel, the following vulnerability has been resolved:

fs/ntfs3: fix slab-out-of-bounds write in nicreateattr_list()

nicreateattrlist() allocates a fixed buffer of alaligned(record_size)

(== record_size) bytes and then walks every attribute of the primary MFT

record, writing one ATTRLISTENTRY per attribute and advancing the cursor

by lesize(namelen), with no check against the end of the buffer; the

total size is only computed after the loop.

A minimum-size resident attribute occupies SIZEOF_RESIDENT (0x18 = 24)

bytes on disk, but an unnamed attribute expands to le_size(0) (0x20 = 32)

bytes in the list.  Because the number of attributes in a record is not

bounded (mienumattr() accepts arbitrarily many equal-type, nameless

minimum-size attributes), a crafted record packed with such attributes

produces a list larger than record_size and overflows the heap buffer.

This is reachable from a crafted, loop-mounted NTFS image: opening the file

and adding an attribute (e.g. via setxattr) drives ntfssetea() ->

niinsertresident() -> niinsertattr() -> niinsattr_ext() ->

nicreateattr_list().

  BUG: KASAN: slab-out-of-bounds in nicreateattr_list+0xc48/0x1058

  Write of size 4 at addr ffff000008984c00 by task setfattr/345

   nicreateattr_list+0xc48/0x1058

   niinsattr_ext+0x510/0x7c0

   niinsertattr+0x3f8/0x70c

   niinsertresident+0xc8/0x3b0

   ntfssetea+0x66c/0xd28

   ntfs_setxattr+0x4d8/0x5b0

   _arm64sys_setxattr+0xa4/0x124

  Allocated by task 345:

   nicreateattr_list+0x188/0x1058

  The buggy address belongs to the cache kmalloc-1k of size 1024

  (the write lands at object+1024).

Size the buffer from the actual attributes instead of assuming a single

record_size is always enough.