# Linux 7.4 hardens NTFS3 driver against malicious and corrupted NTFS volumes

> **Key takeaway:** The NTFS3 in-kernel driver receives extensive fuzzing-driven fixes for memory safety vulnerabilities including heap leaks, overflows, and uninitialized data exposure.

**Published:** 2026-10-28T10:02:34+00:00 
**Source:** Phoronix Benchmarks & Drivers 
**Category:** kernel-os 
**Canonical URL:** https://fosswire.org/news/linux-74-hardens-ntfs3-driver-against-malicious-and-corrupte.html 

## Summary
Paragon Software's Konstantin Komarov has submitted a pull request hardening the NTFS3 read/write driver for Linux 7.4 against corrupted or maliciously-crafted NTFS volumes. The update addresses multiple memory safety issues discovered through fuzzing and Kernel Address Sanitizer (KASAN) testing, including a 64KB kernel heap leak to user-space, heap overflow conditions, and uninitialized page cache contents being returned from damaged compressed files.

The changes also introduce a new 'ugm' mount option enabled by default in WSL3 contexts, which controls whether newly created files receive WSL-specific uid/gid/mode extended attributes that Windows does not natively use. These fixes apply to the NTFS3 driver originally contributed by Paragon Software, which remains distinct from the newer 'NTFS' driver that merged in Linux 7.1 as part of the 'NTFS Resurrection' effort.

## NTFS3 hardening fixes and mount option changes
- **Memory leak prevention:** Fixes eliminate a possible 64KB leak of kernel heap memory to user-space when handling malformed NTFS structures.
- **Uninitialized data exposure:** Patched a bug where damaged compressed files could return uninitialized page cache contents to user-space, potentially leaking sensitive kernel memory.
- **Heap overflow remediation:** Multiple heap overflow conditions identified through fuzzing have been addressed in the C driver implementation.
- **MFT record bounds checking:** Corrected mount-time behavior that could write past the Master File Table (MFT) record buffer boundary.
- **WSL3 mount option:** New 'ugm' parameter defaults to enabled; setting 'ugm=0' suppresses WSL-specific uid/gid/mode extended attributes on newly created files for compatibility with Windows-native environments.

## Why it matters
These hardening improvements reduce attack surface for Linux systems mounting external or untrusted NTFS storage, including dual-boot configurations, removable media, and forensic analysis workflows. The fixes are particularly relevant for WSL3 users and security-conscious deployments where maliciously-crafted filesystem images pose a kernel exploitation risk.