CVE-2026-98136

Executive Summary

CVE-2026-98136 is a slab-out-of-bounds read vulnerability in the Linux kernel NTFS driver, specifically within the ntfs_attr_find_in_attrdef() function. When a crafted NTFS volume is mounted whose $AttrDef data size is smaller than a single 160-byte attr_def entry, the kernel reads past the end of the allocated vol->attrdef buffer during file creation operations. This flaw affects Linux systems that mount untrusted or attacker-controlled NTFS images, typically via removable media, loopback devices, or container image parsing, potentially causing kernel crashes (denial of service) and leaking adjacent memory contents; because the vulnerable path is reachable by unprivileged local users who can trigger file creation on such a mount, it constitutes a local attack surface with possible privilege-escalation implications.

Technical Analysis

The vulnerability resides in the NTFS filesystem driver of the Linux kernel. The function ntfs_attr_find_in_attrdef() iterates over the in-memory $AttrDef table using a loop that bounds only the start address of each entry rather than the entire entry:

for (ad = vol->attrdef; (u8 *)ad - (u8 *)vol->attrdef <
        vol->attrdef_size && ad->type; ++ad)

Because struct attr_def is 160 bytes and the guard dereferences ad->type at offset 128, the pointer arithmetic advances by 160 bytes each iteration while the guard only verifies that the start of the entry is within vol->attrdef_size. If vol->attrdef_size is smaller than 160 bytes — for example 120 bytes — the loop's condition still reads ad->type at offset 128, which lies past the end of the allocation. The allocation itself (kvzalloc(i_size)) is sized to the on-disk $AttrDef data size, and load_and_init_attrdef() only validates that 0 < i_size <= 0x7fffffff, so no minimum-size check exists to ensure at least one complete attr_def entry fits.

The out-of-bounds read is triggered through the call chain ntfs_attr_add → ntfs_attr_can_be_non_resident → ntfs_attr_size_bounds_check → ntfs_attr_find_in_attrdef, which is reached when a file is created on a mounted NTFS volume. The kernel reports a KASAN slab-out-of-bounds read of size 4 at the address of the ad->type field. The result is an information disclosure of up to 4 bytes of adjacent slab memory per read and, depending on the slab layout, potential kernel instability. The fix requires both tightening the loop guard to ensure the entire 160-byte entry lies within attrdef_size and rejecting at mount time any $AttrDef that is too small to hold a single attr_def entry.

Exploitation Scenarios

No public proof-of-concept or exploit code is known for this vulnerability; the following attack chain is inferred from the vulnerability class (out-of-bounds read in a filesystem parser) and the NVD description.

1. Reconnaissance / target identification: An attacker identifies a Linux host that will mount an NTFS volume from an untrusted source. Because the vulnerable code path executes during normal filesystem operations (file creation) once a malformed NTFS image is mounted, the attacker does not need to target a particular kernel build; any system with the affected NTFS driver and the necessary privileges or auto-mount configuration is a candidate. Typical vectors are removable media (USB drives), disk images consumed by hypervisors or containers, and loopback-mounted files.

2. Triggering the flaw: The attacker crafts an NTFS volume whose $AttrDef data size is set below the 160-byte size of a single attr_def entry (for example, 120 bytes). When the volume is mounted, load_and_init_attrdef() allocates a buffer of the on-disk size without enforcing a minimum of one entry. Later, when a file is created on that volume, the kernel path ntfs_attr_add → ntfs_attr_can_be_non_resident → ntfs_attr_size_bounds_check → ntfs_attr_find_in_attrdef executes and the loop guard fails to contain the entire entry, causing ad->type to be read past the end of the allocation.

3. Payload/execution method: The vulnerability is triggered simply by mounting the malicious image and performing a file-creation operation. The "payload" is the malformed on-disk NTFS metadata (the undersized $AttrDef), not executable code. No memory write primitive is described, so the immediate effect is an out-of-bounds read of adjacent slab memory (4 bytes per dereference along the walk).

4. Post-exploitation impact: The most reliable outcome is a kernel crash or denial of service because the out-of-bounds access violates slab boundaries and triggers KASAN reports (and potentially panics on hardened configurations). Where the read does not immediately fault, adjacent kernel memory is disclosed into structures derived from the walked entry, which could leak sensitive in-memory data and, in combination with other bugs, contribute to further exploitation. The description does not demonstrate a write primitive or direct code execution, so privilege escalation should be treated as a possibility rather than a confirmed outcome.

Impact Assessment

This is a local attack (AV:L) requiring low privileges (PR:L) and no user interaction (UI:N) under a typical CVSS:3.1 interpretation, with low attack complexity (AC:L). The confidentiality impact is high in the sense that kernel memory contents may be disclosed, and the availability impact is high because the out-of-bounds read can crash the kernel on a KASAN-enabled or hardened system. Integrity impact is not directly demonstrated by the described read-only out-of-bounds access and is therefore scored as none. The blast radius is limited to systems that mount attacker-controlled or otherwise untrusted NTFS volumes; it does not affect remote unauthenticated network exposure of a service. Business impact centers on denial of service (system unavailability, forced reboots, potential data loss if the crash occurs while writing), and on information disclosure risk where the system handles sensitive data in kernel memory. Because a fix is not yet available in tracked sources, unpatched production hosts that process untrusted NTFS images remain at risk, particularly in multi-tenant or forensics environments that routinely mount third-party volumes.

Detection Guidance

Sigma Rule

title: Linux Kernel NTFS $AttrDef Out-of-Bounds Read Attempt
id: 3f9c7b2e-6a41-4d8e-9b0f-2c5a7e1d8f34
status: experimental
description: Detects kernel messages indicating an out-of-bounds read in ntfs_attr_find_in_attrdef, consistent with CVE-2026-98136 exploitation.
logsource:
  product: linux
  service: kernel
detection:
  keywords:
    - 'ntfs_attr_find_in_attrdef'
    - 'slab-out-of-bounds'
    - 'ntfs_attr_size_bounds_check'
    - 'ntfs_attr_can_be_non_resident'
  condition: 1 of keywords
falsepositives:
  - Legitimate kernel debugging or KASAN testing
level: high
tags:
  - attack.t1068
  - cve.2026.98136

YARA Rule

rule CVE_2026_98136_NTFS_AttrDef_OOB
{
    meta:
        description = "Detects crafted NTFS volumes with undersized $AttrDef data size (CVE-2026-98136)"
        author = "Threat Intelligence"
        date = "2026-01-01"
        reference = "CVE-2026-98136"
    strings:
        $attrdef_magic = { 24 41 54 54 52 44 45 46 } // "$ATTRDEF"
    condition:
        $attrdef_magic and filesize > 512
}

Suricata IDS Rule

alert ip any any -> any any (msg:"CVE-2026-98136 NTFS AttrDef out-of-bounds read attempt (ntfs_attr_find_in_attrdef)"; content:"$AttrDef"; nocase; flow:to_server; classtype:attempted-admin; reference:cve,2026-98136; sid:202698136; rev:1;)

Elastic Detection

process where event.type == "start" and
  process.name == "mount" and
  process.args : "*ntfs*"

Splunk SPL Query

index=linux sourcetype=syslog (""ntfs_attr_find_in_attrdef"" OR ""slab-out-of-bounds"" OR ""$AttrDef"")
| stats count by host, _time, message
| where count > 0

Wazuh OSSEC Rule

<group name="linux,cve-2026-98136,">
  <rule id="100981" level="12">
    <decoded_as>syslog</decoded_as>
    <match>ntfs_attr_find_in_attrdef|slab-out-of-bounds</match>
    <description>CVE-2026-98136: Kernel out-of-bounds read in NTFS $AttrDef handling detected</description>
    <mitre>
      <id>T1068</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations:

   • Avoid mounting NTFS volumes from untrusted sources (removable media, downloaded disk images, third-party container images) on production hosts.
   • Disable or restrict the NTFS kernel module (modprobe -r ntfs / blacklist it) on systems that do not require NTFS support.
   • Prefer user-space NTFS implementations (for example, FUSE-based drivers) that run outside the kernel for handling untrusted images where feasible.
   • Enforce least privilege so that unprivileged local users cannot mount arbitrary images, and disable automatic mount/auto-run for removable media.

2. Patch/upgrade steps:

   • Monitor Linux kernel stable and distribution security advisories for a fix that enforces the full-entry bounds check in ntfs_attr_find_in_attrdef() and rejects at mount time any $AttrDef too small to hold one attr_def entry.
   • Once the patched kernel is available, upgrade and reboot promptly; verify the running kernel version after reboot.

3. Long-term hardening:

   • Run kernels with KASAN or similar memory-safety instrumentation in test/staging to catch parser boundary bugs early.
   • Apply mandatory access control (SELinux/AppArmor) to constrain which processes can mount filesystems.
   • Integrate filesystem image validation into ingestion pipelines so malformed NTFS images are rejected before reaching the kernel driver.

References

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-98136
• Linux kernel source (NTFS driver): https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
• CISA Known Exploited Vulnerabilities catalog (not listed as of this report): https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• CWE-125 Out-of-bounds Read: https://cwe.mitre.org/data/definitions/125.html
• ATT&CK T1068 Exploitation for Privilege Escalation: https://attack.mitre.org/techniques/T1068/

No public proof-of-concept, exploit code, or in-the-wild campaign evidence was identified in the provided data for CVE-2026-98136.