Re: [PATCH] ntfs: verify run length exceeding volume boundary

[Namjae Jeon]

On Tue, Aug 11, 2026 at 11:15 AM Hongling Zeng <zenghongling@xxxxxxxxxx> wrote:
>
> The mapping pairs decoder validates that the starting LCN is within the
> volume but does not check if the run extends beyond the volume boundary.
>
> A malformed NTFS image with a crafted mapping pairs array could cause
> the kernel to access memory beyond the volume boundary, potentially leading
> to memory corruption and privilege escalation.
>
> Add validation to ensure lcn + length stays within nr_clusters.
>
> Cc: stable@xxxxxxxxxxxxxxx
> Fixes: b4be3a47f8ba4 ("ntfs: bound the free-cluster bitmap scan to the volume")
> Signed-off-by: Hongling Zeng <zenghongling@xxxxxxxxxx>
Applied it to #ntfs-next.
Thanks!