NTFS-3G 2026.9.18 Patches Eight NTFS Memory-Safety Bugs

NTFS-3G 2026.9.18 Patches Eight Advisories in One Drop​

The upstream release on GitHub calls itself "Security Release 2026.9.18 (September 23, 2026)". It ships as the source tarball ntfs-3g_ntfsprogs-2026.9.18.tgz with the SHA-256 checksum bcf3cf301a79e42d330128ffb52d4cf615bd1d30c10a92d9d8d14f2bb4fcd9bf. Phoronix reported the release first, and 9to5Linux covered it independently later the same day. Phoronix summarized it this way: NTFS-3G "was affected by a number of heap buffer overflows, possible heap data corruption, a denial of service vector, and other issues".

The fixes marked with GitHub Security Advisory (GHSA) identifiers are:

Three other changes come with them. The release adds a guard against multiple creator-owner and creator-group access-control entries (ACEs) during ACL inheritance. It fixes missing cleanup of an opened attribute on error in ntfscat (#212). And it fixes stale $MFTMirr data in ntfsresize when the first extent of $MFT is moved. $MFT is NTFS's Master File Table, the index of every file on the volume, and $MFTMirr is its backup copy. If a resize leaves that backup stale, the volume's own redundancy is out of step with reality. That is a data-integrity bug more than a security one, but anyone who resizes Windows partitions from a Linux live environment should care about it.

Tuxera credits Jurre van Bergen and France's national cybersecurity agency, ANSSI, with the security reports behind this release. The notes list no CVE identifiers, severity scores, affected-version ranges or exploitation conditions. None of the coverage reports any known exploitation, and WindowsForum has not reproduced any of the bugs.

Why Parsing Bugs in NTFS-3G Reach Windows Users​

NTFS-3G's own description calls it an open-source read/write NTFS driver for Linux, FreeBSD, macOS, NetBSD, OpenIndiana, QNX and Haiku. It supports file ownership and permissions, POSIX ACLs, junction points and extended attributes. It runs through FUSE (Filesystem in Userspace), so the driver runs as a normal process instead of inside the kernel. Phoronix describes it as a choice for Linux and other FUSE-supported platforms as an alternative to the in-kernel NTFS and NTFS3 Linux drivers.

For WindowsForum readers, NTFS-3G is the software in the middle whenever a non-Windows system touches a Windows disk. Common cases include a dual-boot Linux install mounting the Windows partition, a Linux recovery USB used to copy files off an unbootable Windows 11 PC, a NAS or home server reading an NTFS external drive, and a technician running ntfsfix, ntfsclone, ntfsresize or ntfsundelete on a client's disk. The ntfsprogs suite covers all of those jobs. It formats, labels, resizes, clones, inspects and recovers NTFS volumes.

Windows' own NTFS driver is a separate codebase and is not affected by this release. The in-kernel Linux NTFS3 driver is a different implementation too. These advisories apply to NTFS-3G and its library, libntfs-3g, and not to NTFS in general.

Malformed Volumes Are the Recurring Threat Model Behind NTFS-3G Fixes​

The September notes name functions but not attack scenarios. The July release fills in part of that gap. Tuxera announced the 2026.7.7 security release on July 15, and its changelog repeatedly describes bugs triggered by "a corrupt or maliciously crafted filesystem". Examples include heap memory corruption in ntfscat (CVE-2026-42616), an out-of-bounds read on symlink reparse data (CVE-2026-46571), and a heap buffer overflow when building inherited ACL data (CVE-2026-56135). The April release, 2026.2.25, fixed a heap buffer overflow when POSIX ACLs were enabled (CVE-2026-40706).

The function names in September point at the same kind of code. ntfs_mapping_pairs_decompress_i() decodes the run lists that map a file's data onto disk clusters. ntfs_check_restart_area() validates the transaction log's restart area. ntfs_same_sid() and ntfs_acl_owner() deal with security descriptors. ntfs_ea_check_wsldev() checks extended attributes used for WSL-style device files. All of these read structures from the disk itself. My inference is that a crafted NTFS image or USB stick is the most plausible trigger for most of these bugs. Tuxera has not published that analysis for the September fixes, so treat it as a working assumption and not as a documented attack path.

The practical risk rises in any setup where NTFS-3G handles a volume someone else prepared. Desktops that auto-mount removable media fit that description. So do forensic and data-recovery workstations and servers that ingest customer drives. A Linux laptop that only ever mounts its owner's own Windows partition has a much smaller exposure.

How Distributions Handled the Last NTFS-3G Security Release​

Tuxera recommends distribution packages for most people. The README says most distributions carry an up-to-date NTFS-3G package and that installing it is the preferred route. None of the reporting so far says when specific distributions will ship 2026.9.18.

The July release gives some precedent. SUSE published advisory SUSE-SU-2026:3214-1 on July 23, 2026, rated important, eight days after upstream. That update covered nine vulnerabilities in ntfs-3g_ntfsprogs, including heap buffer overflows and out-of-bounds reads that could lead to heap corruption and information disclosure. SUSE scored CVE-2026-42618 at CVSS 4.0 6.9 with a local attack vector. That score belongs to a July bug and says nothing about how anyone will rate the September advisories. It does show that at least one major distribution treated the previous batch as an important patch and moved within about a week.

NTFS-3G Versus the In-Kernel NTFS3 Driver​

This release also brings back an old question: should Linux users run NTFS-3G at all? 9to5Linux argues against it, noting that because NTFS-3G runs in userspace, every file transfer passes data back and forth between user and kernel mode, which creates a CPU bottleneck and slower read/write speeds. The outlet recommends Linux's native in-kernel NTFS3 driver developed by Paragon Software.

That argument is about performance. It is not a security comparison, and neither outlet offers evidence on which driver has fewer parsing bugs. FUSE does keep NTFS-3G's parsing code out of kernel space, so a memory-corruption bug there hits a user-space process and not the kernel itself. How much protection that gives depends on how the driver is run, which is usually as root when mounting. NTFS-3G also has advantages NTFS3 cannot replace. Its ntfsprogs utilities have no in-kernel equivalent, and it runs on macOS, the BSDs and Haiku, where NTFS3 is not available.

Switching drivers is a reasonable choice for a Linux desktop that mostly wants fast access to a Windows data partition. It does not replace patching if you still use ntfsprogs, and the September fixes include tool-level bugs in ntfscat and ntfsresize.

What this means for you​

If NTFS-3G is on your machine, update it through your distribution when 2026.9.18 appears, and do it sooner where untrusted drives get mounted. On most distributions NTFS-3G is a separate package you can look up with your package manager. That also tells you which version you have. If you use the in-kernel NTFS3 driver and never installed NTFS-3G or ntfsprogs, this release does not apply to you.

For source-built installs, the documented path is to unpack the official tarball, confirm the SHA-256 above, and then run:

1. ./configure (run ./configure --help for options such as --enable-posix-acls or --disable-ntfsprogs)
2. make
3. make install (or sudo make install if you are not root)

Tuxera's README also describes a way to test a new build without replacing the installed one. After ./configure and make, the build creates ntfs-3g and lowntfs-3g scripts in the src directory. As root, you can mount with src/ntfs-3g [-o mount-options] /dev/sda1 /mnt/windows and unmount with umount when you are done. Use your real device and mount point in place of the examples.

• Install NTFS-3G 2026.9.18 from your distribution as soon as it is packaged. Upstream has not given a timeline for any distro.
• Put recovery, forensic and intake machines that mount customer or unknown NTFS drives at the front of the queue.
• If you build from source, check the tarball against SHA-256 bcf3cf301a79e42d330128ffb52d4cf615bd1d30c10a92d9d8d14f2bb4fcd9bf before compiling.
• If you resize Windows partitions with ntfsresize from Linux, update first, because the $MFTMirr fix affects moving the start of the MFT.
• Windows' built-in NTFS driver and Linux's in-kernel NTFS3 driver are separate code and do not need action for this release.
• If you are still on a version older than 2026.7.7, you are also missing the nine CVE fixes from July.

Three releases in five months, two of them marked as security releases, show that NTFS-3G's metadata parsers are getting sustained scrutiny from researchers such as van Bergen and agencies such as ANSSI. Anyone who relies on NTFS-3G should expect more releases like this one. The next step is distribution packaging. The July precedent suggests the major vendors could have 2026.9.18 out within days, and until then, hosts that mount unfamiliar NTFS media should do so carefully.