CVE-2026-72195

Status: UPDATED  |  Advisory ID: CVE-2026-72195

Key Details

Affected Products, Subsystems & Sectors

What to Know

In the Linux kernel, the following vulnerability has been resolved:

fs/ntfs3: bound attr_off in UpdateResidentValue against data_off

In do_action()'s UpdateResidentValue case (fslog.c:3307),

lrh->attr_off and lrh->redo_len come from the on-disk LRH.

When they satisfy aoff + dlen < attr->res.data_off, the

assignment

attr->res.data_size = cpu_to_le32(aoff + dlen - data_off);

underflows to ~4 GiB (e.g. 0xFFFFFFF9 when aoff=0x10, dlen=1,

data_off=0x18). Subsequent code that reads attr->res.data_size

to walk the resident attribute payload would then read up to

4 GiB past the 1024-byte MFT record allocation.

The existing mi_enum_attr() defense in fs/ntfs3/record.c:287

catches the corrupted data_size on the next attribute walk

and fails the mount, but only on the path that walks all

attributes. A read site that picks an attribute by name and

reads its data_size without re-validating is not covered.

Validate aoff against data_off and asize at the source.

Reproduced under UML+KASAN on mainline 8d90b09e6741 via

pr_warn-only probe: with aoff=0x10 and data_off=0x18, the

post-assignment data_size is 0xfffffff9 (mount then fails

at -22 from mi_enum_attr).

[[email protected]: clang-formatted the changes] (NVD)

What to Do

Monitor Linux's web page for any future patch releases.

References