{
  "affected": [
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:12",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:13",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:14",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:  fs/ntfs3: fix slab-out-of-bounds write in ni_create_attr_list()  ni_create_attr_list() allocates a fixed buffer of al_aligned(record_size) (== record_size) bytes and then walks every attribute of the primary MFT record, writing one ATTR_LIST_ENTRY per attribute and advancing the cursor by le_size(name_len), with no check against the end of the buffer; the total size is only computed after the loop.  A minimum-size resident attribute occupies SIZEOF_RESIDENT (0x18 = 24) bytes on disk, but an unnamed attribute expands to le_size(0) (0x20 = 32) bytes in the list.  Because the number of attributes in a record is not bounded (mi_enum_attr() accepts arbitrarily many equal-type, nameless minimum-size attributes), a crafted record packed with such attributes produces a list larger than record_size and overflows the heap buffer.  This is reachable from a crafted, loop-mounted NTFS image: opening the file and adding an attribute (e.g. via setxattr) drives ntfs_set_ea() -\u003e ni_insert_resident() -\u003e ni_insert_attr() -\u003e ni_ins_attr_ext() -\u003e ni_create_attr_list().    BUG: KASAN: slab-out-of-bounds in ni_create_attr_list+0xc48/0x1058   Write of size 4 at addr ffff000008984c00 by task setfattr/345    ni_create_attr_list+0xc48/0x1058    ni_ins_attr_ext+0x510/0x7c0    ni_insert_attr+0x3f8/0x70c    ni_insert_resident+0xc8/0x3b0    ntfs_set_ea+0x66c/0xd28    ntfs_setxattr+0x4d8/0x5b0    __arm64_sys_setxattr+0xa4/0x124   Allocated by task 345:    ni_create_attr_list+0x188/0x1058   The buggy address belongs to the cache kmalloc-1k of size 1024   (the write lands at object+1024).  Size the buffer from the actual attributes instead of assuming a single record_size is always enough.",
  "id": "DEBIAN-CVE-2026-90048",
  "modified": "2026-09-17T04:47:34.751184195Z",
  "published": "2026-09-16T11:17:18.140Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://security-tracker.debian.org/tracker/CVE-2026-90048"
    }
  ],
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "upstream": [
    "CVE-2026-90048"
  ]
}