Linux 7.3 NTFS Driver Gains Read Support for Windows WOF Files

The important practical detail is easily lost in the shorthand: this is support for Windows’ newer system compression format, not the conventional NTFS compression that Linux drivers have handled separately. Microsoft uses WOF-backed compression for Compact OS, which allows Windows to run operating-system files in compressed form, and for executable-oriented compression using XPRESS or LZX algorithms. A Linux machine mounting such an NTFS volume could previously encounter files that existed on disk but could not be read correctly through the newer driver.

For dual-boot users, recovery technicians, and administrators examining offline Windows disks, the improvement means Linux 7.3 may be able to read a fuller picture of a Windows installation without first booting Windows to decompress selected files. It is a targeted interoperability improvement rather than a general recommendation to use Linux as the tool for modifying a Windows system partition.

The feature belongs to the new ntfs driver, not NTFS3​

Phoronix reports that Namjae Jeon’s modern Linux NTFS driver now has optional WOF read support behind a new kernel configuration setting, CONFIG_NTFS_FS_WOF_COMPRESSION. The driver adds in-kernel decompressors for XPRESS 4K, XPRESS 8K, XPRESS 16K, and LZX 32K data, allowing it to process the compressed file data during the page-read path.

That driver must be distinguished from NTFS3, the older Paragon-developed driver that arrived in the Linux kernel in 2021. Both driver streams have updates proposed for Linux 7.3, and both are discussed in the same Phoronix report, but WOF support is assigned to the newer ntfs implementation. The NTFS3 changes are largely fixes and validation work, plus initial alternative-data-stream support.

That distinction matters for Linux distributions and users who explicitly select a filesystem driver in /etc/fstab or at mount time. A system mounting a Windows volume through ntfs3 does not gain the new WOF reader merely because it upgrades to a Linux 7.3-based kernel. The feature is in the modern driver, whose filesystem type is ntfs, and it also depends on the distribution kernel having been built with the new WOF configuration enabled.

Tom’s Hardware previously described the new driver’s arrival in Linux 7.1 as an attempt to replace legacy infrastructure with a modern in-kernel implementation using iomap and folio-based memory management. The WOF work is therefore more than a decompressor bolted onto an old compatibility layer: it is one of the first Windows-specific format additions to a driver Linux developers intend to maintain as a current NTFS implementation.

WOF is different from ordinary NTFS compression​

Windows has long included traditional NTFS compression, which marks files or directories as compressed at the filesystem level. WOF, short for Windows Overlay Filter, is a different mechanism designed for read-mostly content such as operating-system binaries and preinstalled application files.

Microsoft’s current compact documentation lists XPRESS4K, XPRESS8K, XPRESS16K, and LZX as the algorithms available with the /EXE switch. The same command exposes Compact OS controls through /CompactOS, including the ability to query whether an installation is running its system files in compressed form. Microsoft’s deployment documentation says Compact OS is supported on Windows 10 and Windows 11 and allows the operating system to run directly from compressed files.

That is why the new Linux support has a narrow but real value. A standard Windows data partition may have little or no WOF content. An offline Windows installation, a compacted OEM image, or a directory deliberately compressed with compact /EXE is more likely to contain it. The formats are optimized around files expected to be read frequently and altered rarely; Microsoft notes that executable-compressed files are automatically decompressed if an application opens them for writing.

The Linux driver is following that same boundary conservatively. It can decode the compressed data for reads, but it does not offer write support for WOF-backed files. Attempting to treat this as full read-write compatibility would be a mistake, especially on a Windows boot volume where a change to one protected or compressed file can have servicing consequences later in Windows.

The new option is not a universal Linux 7.3 switch​

The WOF capability is controlled by a Kconfig option, which means kernel builders decide whether it exists in a particular kernel image. Phoronix identifies the option but does not report its default setting, and no distribution maintainer announcement has yet established which Linux distributions will enable it in their Linux 7.3 packages.

That leaves three separate milestones before ordinary users can count on it:

• Linux maintainers must accept the submitted driver changes into the Linux 7.3 tree.
• Distribution kernel maintainers must compile the modern ntfs driver with WOF compression enabled.
• Users must actually mount the volume through the modern ntfs driver rather than NTFS3, NTFS-3G, or another configured implementation.

Linux 7.3 is also a kernel development cycle, not a finished distribution release. The pull request is evidence that the code has been proposed for integration; it is not a promise that every downstream distribution will ship the feature immediately, or at all. No other outlet has reported distribution rollout plans as of August 25, 2026.

Administrators building their own kernels have a clearer path: verify the target kernel’s configuration and confirm that the ntfs filesystem driver, rather than ntfs3, is selected for the test volume. For managed fleets, it is wiser to validate the behavior against representative Windows images before changing automated recovery or forensic workflows.

Better recovery access, not a reason to mount Windows writable​

The feature is most useful in situations where Windows cannot be booted normally but an administrator needs to copy data, inspect an offline image, or verify the contents of a Windows installation from Linux. Compact OS was built to save storage while keeping files transparently usable under Windows; a Linux reader that cannot decode those files turns a storage optimization into an interoperability blind spot.

The Linux 7.3 work also includes malformed-filesystem hardening, compressed-I/O path improvements, and validation fixes in the new driver, according to Phoronix. Those fixes are relevant because NTFS volumes encountered during recovery are often the very volumes that were not cleanly shut down or that require careful handling. They should not be interpreted as a guarantee that a damaged Windows volume is safe to modify from Linux.

For now, the sensible operational rule remains simple: use the forthcoming WOF support to read and extract data from Windows NTFS volumes, especially offline Compact OS installations, but make changes through Windows when possible. Linux 7.3’s new reader fills an important compatibility gap; it does not eliminate the risk of editing a Windows installation with a driver stack Windows itself does not use.