CVE-2026-43245
Awaiting Analysis Awaiting Analysis - Queue
Linux kernel NTFS d_compare blocking vulnerability

Publication date: 2026-05-06

Last updated on: 2026-05-06

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: ntfs: ->d_compare() must not block ... so don't use __getname() there. Switch it (and ntfs_d_hash(), while we are at it) to kmalloc(PATH_MAX, GFP_NOWAIT). Yes, ntfs_d_hash() almost certainly can do with smaller allocations, but let ntfs folks deal with that - keep the allocation size as-is for now. Stop abusing names_cachep in ntfs, period - various uses of that thing in there have nothing to do with pathnames; just use k[mz]alloc() and be done with that. For now let's keep sizes as-in, but AFAICS none of the users actually want PATH_MAX.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-05-06
Last Modified
2026-05-06
Generated
2026-05-07
AI Q&A
2026-05-06
EPSS Evaluated
N/A
NVD
CVE-2026-43245
EUVD
EUVD-2026-27806
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN
Attack-Flow Graph
AI Powered Q&A
How can this vulnerability impact me? :

This vulnerability relates to the Linux kernel's handling of NTFS filesystem operations, specifically in the ->d_compare() function and related code. The issue involves improper blocking behavior and misuse of memory allocation functions, which could potentially lead to stability or performance problems in the kernel when dealing with NTFS filesystems.

While the exact impact is not detailed, such kernel-level issues can cause system crashes, hangs, or unexpected behavior when accessing NTFS filesystems, potentially affecting system reliability.


Can you explain this vulnerability to me?

This vulnerability in the Linux kernel relates to the NTFS filesystem code, specifically the ->d_compare() function. The issue is that ->d_compare() must not block, but it was using __getname(), which can block. The fix involves switching to kmalloc(PATH_MAX, GFP_NOWAIT) for memory allocation to avoid blocking. Additionally, the code stops misusing the names_cachep cache in NTFS, replacing it with proper memory allocation methods like kmalloc or kzalloc.


What immediate steps should I take to mitigate this vulnerability?

The vulnerability has been resolved in the Linux kernel by modifying the ntfs module to avoid blocking in ->d_compare() and by switching memory allocation methods to kmalloc(PATH_MAX, GFP_NOWAIT).

To mitigate this vulnerability, you should update your Linux kernel to the version that includes this fix.


How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:

There is no information provided about the impact of this vulnerability on compliance with standards or regulations such as GDPR or HIPAA.


Ask Our AI Assistant
Need more information? Ask your question to get an AI reply (Powered by our expertise)
0/70
EPSS Chart