CVE-2026-53023: Linux NTFS3 Out-of-Bounds Read in Volume Label Handling

Technical summary

The ntfs_fill_super() function in fs/ntfs3 calls utf16s_to_utf8s() to convert an on-disk NTFS volume label from UTF-16 to UTF-8 encoding and stores the result in sbi->volume.label. The conversion function returns only the byte count written and does not append a null terminator. Subsequently, ntfs3_label_show() exposes this label via a sysfs interface using the %s format specifier, which assumes a null-terminated string. If the converted label consumes the entire fixed-size buffer, the subsequent string display operation performs an out-of-bounds read while searching for the terminating null byte. The fix requires explicitly null-terminating the buffer after successful conversion and clamping the exact-full edge case to reserve space for the null terminator.

Business impact

Systems running the NTFS3 driver with mounted NTFS volumes face denial-of-service risk. An unprivileged local user with access to the system can trigger the out-of-bounds read by querying the volume label, potentially causing a kernel panic or system hang. This affects enterprises using Linux servers that serve or cache NTFS-formatted storage, including shared hosting environments, containerized deployments, and dual-boot or USB-accessible systems. The impact is limited to availability; data confidentiality and integrity are not directly affected.

Affected systems

All versions of the Linux kernel with the NTFS3 file system driver that have not applied the corrective patch are affected. The vulnerability exists in kernels where ntfs3 is compiled in or loaded as a module. Systems not using NTFS3 (whether using the legacy ntfs driver or no NTFS support at all) are not affected. Check your kernel configuration for CONFIG_NTFS3 to determine exposure.

Exploitability

Exploitation requires local system access and the ability to query volume label information through the sysfs interface. An unprivileged local user can trigger the flaw without special kernel privileges. However, the attack surface is narrowly constrained: the vulnerability only manifests when (1) NTFS3 is active, (2) a volume is mounted with a label that converts to exactly fill the buffer, and (3) the label is queried. No remote exploitation path exists, and the condition is deterministic and reproducible rather than probabilistic. The CVSS score of 5.5 (Medium) reflects local-only access, low attack complexity, and high availability impact with no privilege escalation.

Remediation

Apply the upstream Linux kernel patch that explicitly null-terminates sbi->volume.label after the utf16s_to_utf8s() conversion and ensures the buffer always reserves space for the null terminator. Verify the patch against the Linux kernel source repository or your distribution's security advisory for the specific version being deployed. Systems should upgrade to a kernel version that includes this fix. Until patching is completed, restrict local system access where possible and disable NTFS3 support if NTFS mounting is not required.

Patch guidance

Obtain the patch from your Linux distribution's security advisory or the upstream Linux kernel repository. The fix is typically backported to stable kernel branches (verify against your branch's timeline). For most distributions: Ubuntu, Debian, Red Hat, SUSE, and others will issue kernel security updates that include this patch. Check your vendor's security bulletin for the affected kernel versions and the patched versions available for your supported releases. If using a custom kernel, apply the patch directly to fs/ntfs3/super.c before recompiling.

Detection guidance

Monitor kernel logs for out-of-bounds read warnings, page faults, or kernel panics occurring during NTFS volume label access. Systems can verify their NTFS3 status by checking kernel config: cat /boot/config-$(uname -r) | grep NTFS3. Test for the condition in your environment by mounting a specially crafted NTFS volume with a label that exactly fills the conversion buffer and querying the label via sysfs (cat /sys/class/block/sdXN/device/volume_label or equivalent). Vulnerability scanners that assess kernel version against CVE databases will flag this issue.

Why prioritize this

Although rated MEDIUM severity, prioritize this patch for systems running NTFS3 with untrusted local users because the denial-of-service impact is direct and easily triggered. Kernel availability is critical to most operations. Systems with strong local access controls may defer patching, but systems in multi-user or containerized environments should treat this as near-high priority. The fix carries low risk (a simple buffer termination change) and should be tested and deployed within your standard kernel update cycle.

Risk score, explained

CVSS 5.5 (Medium) reflects: Local access requirement (AV:L) eliminates broad attack surface; Low attack complexity (AC:L) means no user interaction or race conditions needed; Low privilege requirement (PR:L) allows unprivileged users to trigger the flaw; No impact to confidentiality or integrity (C:N/I:N); High availability impact (A:H) due to potential kernel panic. The score appropriately places this below critical/high but above low, warranting timely remediation for systems where NTFS3 is enabled and local access exists.

Frequently asked questions