Linux Kernel NTFS3 Driver Vulnerable to Information Disclosure
A vulnerability in the Linux Kernel's NTFS3 driver allows local attackers to disclose sensitive information, requiring prior code execution.
The Linux Kernel's NTFS3 driver has been found to contain an out-of-bounds read vulnerability, identified as ZDI-26-699, which can lead to the disclosure of sensitive information on affected systems. This vulnerability requires an attacker to first gain the ability to execute low-privileged code on the target system before it can be exploited.
The specific flaw resides within the driver's handling of directory headers in its NTFS3 file system implementation. The issue arises from insufficient validation of user-supplied data, which can permit a read operation to extend beyond the boundaries of an allocated array. Successful exploitation of this vulnerability, when combined with other potential security weaknesses, could theoretically enable an attacker to execute arbitrary code within the context of the kernel.
This vulnerability was reported to the vendor on June 10, 2026, and a coordinated public release of the advisory occurred on September 14, 2026. The advisory was updated on the same day. The CVSS rating for this vulnerability is 5.2, classifying it as medium severity.
Linux has since issued an update to address this vulnerability. The fix can be found in the Linux kernel's commit history, specifically at the commit hash aa1bdbb39f49c5bc9779316891c40005517842a5 on GitHub. Users are advised to update their Linux kernel to the patched version to mitigate the risk.
The vulnerability was discovered and reported by Lucas Leong, affiliated with TrendAI Zero Day Initiative. The disclosure timeline indicates a proactive approach to security, with the vendor being notified well in advance of the public advisory.
While this vulnerability requires local access and prior code execution, it highlights ongoing security challenges within kernel components. Information disclosure vulnerabilities, even those requiring local access, can be a critical stepping stone for attackers aiming to gather intelligence about a system or escalate privileges. The NTFS3 driver, being a component that handles file system operations, is a crucial part of the kernel's functionality.
This disclosure underscores the importance of continuous security auditing and timely patching of core system components like the Linux kernel. As systems become more complex, vulnerabilities in fundamental drivers can have far-reaching implications, especially when combined with other security weaknesses. The prompt release of a patch by the Linux developers demonstrates a commitment to addressing such issues efficiently.
Organizations running Linux systems should prioritize applying the security update for the kernel to protect against potential exploitation of this information disclosure vulnerability. Staying informed about advisories from sources like the Zero Day Initiative and promptly applying vendor-supplied patches are essential practices for maintaining a strong security posture.
This advisory from Zero Day Initiative (ZDI-26-698) details a Linux Kernel vulnerability within the NTFS3 file system driver. The flaw, identified as an out-of-bounds read, allows local attackers with prior low-privileged code execution to disclose sensitive information. The vulnerability was reported on June 10, 2026, and a fix has been integrated into the Linux kernel via a commit on GitHub.
This advisory, ZDI-26-697, details a specific out-of-bounds read vulnerability within the Linux Kernel's NTFS3 driver. The vulnerability stems from improper validation of user-supplied data during the processing of extended attributes, allowing local attackers with prior code execution to disclose sensitive information. The Zero Day Initiative has assigned this vulnerability a CVSS score of 7.3, highlighting its high severity.
The Zero Day Initiative advisory ZDI-26-696 details a heap-based buffer overflow vulnerability within the Linux Kernel's NTFS3 driver, assigned CVE-2026-72196. This new vulnerability, discovered by Meshaal, allows local attackers with low-privileged access to execute arbitrary code by exploiting improper validation of NTFS3 journal log records, leading to a write past the end of an allocated buffer and potential kernel-context code execution. The CVSS score for this vulnerability is rated at 8.8.