CVE-2026-90133

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ntfs: Fix index_root heap OOB write in ntfs_ir_to_ib()

ntfs_ir_to_ib copies all entries from index_root into a freshly allocated

index_block_size-byte buffer without verifying that the entries fit in the

available space. The entries in index_root may be larger than the usable

entry space in the index block.

This can cause OOB writes past the end of the allocation.

The validator ntfs_index_root_inconsistent() checks that entries are

self-consistent within the IR value, but never cross-checks them against

index_block_size. There is no bounds check in ntfs_ir_to_ib() before the

memcpy.

Fixing this at the sink in ntfs_ir_to_ib() since

ntfs_index_root_inconsistent() validates the logical consistency of

index_root as a structure and a root with large entries is a structurally

valid root. The bug is a size conflict of ntfs_ir_to_ib().

Also, the validator is called once per inode load in

ntfs_read_locked_inode() while ntf

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References