NTFS-3G 2026.9.18 was released on September 23 with a set of memory-safety fixes. NTFS-3G is the userspace FUSE driver that let Linux write to Windows drives safely for well over a decade, and it is still installed by default on many distributions along with its ntfsprogs tools.

Why these bugs matter

Filesystem drivers parse on-disk structures, and a USB stick is untrusted input. A crafted NTFS image can target any bug in the parser the moment it is mounted, and some desktops mount removable drives automatically when plugged in.

NTFS-3G runs in userspace, so a bug here compromises the FUSE process rather than the kernel, which limits the damage. But that process often runs as root.

Security fixes

Heap buffer overflows in five functions:

• ntfs_external_attr_find()
• ntfs_ea_check_wsldev(), which handles WSL device metadata
• ntfs_check_restart_area(), in the log file checks
• ntfs_same_sid()
• ntfs_acl_owner()

It also guards against multiple creator-owner and creator-group ACEs during ACL inheritance, which a crafted security descriptor could abuse.

Bug fixes

• Heap out-of-bounds read and write in ntfs_ie_add_vcn()
• Heap corruption in ntfs_mapping_pairs_decompress_i()
• A denial of service in ntfs_inode_attach_all_extents()
• ntfsresize left stale data in $MFTMirr (the backup of the first MFT records) when the first MFT extent was relocated. Windows’ chkdsk would then see a mismatch
• ntfscat did not close an opened attribute

NTFS-3G or the kernel driver?

The in-kernel NTFS driver runs in kernel space and is significantly faster and lighter on CPU than a FUSE driver. Linux 7.1 replaced the in-kernel NTFS driver entirely, and it has been getting steady fixes during the 7.3 cycle.

NTFS-3G remains the conservative option, and its ntfsprogs tools (ntfsfix, ntfsresize, ntfsclone) are useful whichever driver you mount with. Update it through your distribution package manager:

ntfs-3g --version
sudo apt upgrade ntfs-3g    # Debian / Ubuntu
sudo dnf upgrade ntfs-3g    # Fedora

Our mounting drives and fstab guide covers choosing the driver per mount, and dual booting Linux and Windows covers the Fast Startup setting that causes most NTFS “read-only” surprises.