Specially Crafted NTFS File-System Image Allows Root Access On Linux With NTFS3 Driver - Phoronix

Articles & Reviews

News Archive

Forums

Premium Ad-Free<br>Contact

Popular Categories

Close

Articles & Reviews

News Archive

Forums

Premium

Contact

Categories

Computers Display Drivers Graphics Cards Linux Gaming Memory Motherboards Processors Software Storage Operating Systems Peripherals

Specially Crafted NTFS File-System Image Allows Root Access On Linux With NTFS3 Driver

Written by Michael Larabel in Linux Storage on 22 August 2026 at 08:42 AM EDT. 30 Comments

A reported security vulnerability for the NTFS3 driver has gone unaddressed since being reported earlier this summer. The vulnerability allows a pre-crafted NTFS image on a USB flash drive or similar to allow the user to gain root access to the running Linux system.

After being reported privately two months ago and going unresolved, a SUID injection leading to local privilege escalation was made public. A Phoronix reader noted the disclosure via the NTFS3 mailing list.

Vova Tokarev who discovered the issue noted:<br>"A pre-crafted NTFS image (e.g. USB drive) with $LXUID=0, $LXGID=0, $LXMOD=0104755 already in the MFT produces a setuid-root binary the moment the volume is mounted. No setxattr() is involved -- the EAs are on disk. The -EPERM check doesn't help.

The root cause is still at fs/ntfs3/xattr.c:1022:

inode->i_mode = le32_to_cpu(value[2]);

This loads S_ISUID/S_ISGID directly from untrusted on-disk data. Desktop automounters (udisks) mount NTFS with suid by default, so plugging in a crafted USB gives any local user euid=0.

Suggested one-line fix:

- inode->i_mode = le32_to_cpu(value[2]);<br>+ inode->i_mode = le32_to_cpu(value[2]) & ~(S_ISUID | S_ISGID);

I have a full PoC and working demo."

Those interested can find the proof of concept and demo along with more information via this mailing list post.

As of writing the vulnerability has yet to be addressed by the mainline NTFS3 kernel driver. This doesn't appear to impact the newer NTFS driver alternative that also continues maturing within the mainline kernel tree.

30 Comments

Tweet

Longtime Linux CIFS/SMB3 Maintainer Passes Away<br>eCryptfs Sees Fixes For Potential Malicious Intent, Some Dating Back To Its 2006 Debut<br>OpenZFS 2.4.4 Released With Linux 7.2 Support, Dozens Of Fixes<br>FSCRYPT Sees Cleanup With Linux 7.3 To Open Door For More Features Like Btrfs Encryption<br>EXT4 Preps More Performance Improvements For Linux 7.3<br>Btrfs Ready With More Performance Improvements For Linux 7.3: Some ~3x To ~5x Wins

Michael Larabel is the principal author of Phoronix.com and founded the site in 2004 with a focus on enriching the Linux hardware experience. Michael has written more than 20,000 articles covering the state of Linux hardware support, Linux performance, graphics drivers, and other topics. Michael is also the lead developer of the Phoronix Test Suite, Phoromatic, and OpenBenchmarking.org automated benchmarking software. He can be followed via Twitter, LinkedIn, or contacted via MichaelLarabel.com.

Linus Torvalds Endures A Debug Session From Hell, "Enormously Helped" By AI<br>GNOME 51 Beta Released With Many Minor Improvements<br>Linux 7.2 Released With Faster I/O, New AMD & Intel Driver Improvements<br>Omarchy 4.0 Linux Distro Released With Desktop Shell Now Implemented Via Quickshell<br>X.Org Server 26.1 RC1 Prepares For First Feature Release In Five Years<br>Two Very Exciting Memory Management Optimizations Going Into Linux 7.3<br>Linux 7.3 Network Changes Merged But Developers "Completely Overwhelmed" Due To AI/LLMs<br>Modular's Mojo Language Now Open-Source Following Qualcomm Acquisition

Longtime Linux CIFS/SMB3 Maintainer Passes Away

eCryptfs Sees Fixes For Potential Malicious Intent, Some Dating Back To Its 2006 Debut

Redox OS Switches To EEVDF-Based Scheduler For 2.6x Throughput

Specially Crafted NTFS File-System Image Allows Root Access On Linux With NTFS3 Driver

AMD RDNA 4m Firmware Published For Linux Ahead Of Launch

NVK Vulkan Video Merged For Mesa 26.3

Red Hat's Tuned 2.28 To Improve Out-Of-The-Box WiFi Power Savings On Fedora

Linux 7.3 x86/mm Lands Patches To Greatly Improve Latency-Sensitive Workloads

KDE Plasma 6.8 Lands Some Enticing Performance Optimizations This Week

OpenZFS 2.4.4 Released With Linux 7.2 Support, Dozens Of Fixes

Wine 11.16 Released With VA-API Hardware Decoding, Better ARM64 Support

Proton 11.0-2 Enables More Titles With Steam Play / Linux Gaming

AMD Posts Massive Patch Series For Enabling UALink In The Linux Kernel

Linux 7.3 Lands Improvements For Voodoo 3 / 4 / 5 & Vintage Atari Computers In 2026

Phoronix Premium allows ad-free access to the site, multi-page articles on a single page, and other features while supporting this site's continued operations.

Framework Laptop 16 With GeForce RTX 5070 12GB, One-Piece Keyboard & Haptic Touchpad

Intel Hyper Threading Performance On The Xeon 678X "Granite Rapids-WS"

AMD EPYC 9005 Series Memory Scaling...