CVE-2026-90200: In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: fix integer overflow in MFT cluster valid
Summary
A vulnerability in the Linux kernel's NTFS3 file system allowed an integer overflow (when multiplication produces a result too large to store, wrapping to an incorrect small number) in MFT cluster validation. An attacker could craft a malicious boot sector that bypasses safety checks, though currently the system fails later during disk reads rather than causing more severe damage.
Solution / Mitigation
Use check_mul_overflow() (a function that safely detects when multiplication would wrap around) to compute and validate the two sector positions, failing the mount operation if either multiplication overflows. This preserves existing validation logic by checking if mlcn * sct_per_clst >= sectors without relying on the block layer to catch invalid values.
Vulnerability Details
EPSS: 0.0%
September 17, 2026
Classification
Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-90200
First tracked: September 17, 2026 at 02:07 PM
Classified by LLM (prompt v3) · confidence: 95%