CVE-2026-72192

Received Received - Intake

Buffer Overflow in Linux Kernel NTFS3 Driver

Publication date: 2026-08-15

Last updated on: 2026-08-17

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: ntfs3: bound to_move in indx_insert_into_root before hdr_insert_head indx_insert_into_root() promotes a full resident $INDEX_ROOT into $INDEX_ALLOCATION and copies all non-last resident root entries into a newly allocated INDEX_BUFFER via hdr_insert_head(). The source byte count 'to_move' is summed from the on-disk resident entry sizes and is independent of the destination buffer size, which comes from root->index_block_size (via indx->index_bits). A crafted NTFS image that keeps a valid, full resident root but shrinks root->index_block_size down to 512 after the root has been populated makes hdr_insert_head() memcpy attacker-controlled resident entry bytes past the end of the kmalloc(1u << indx->index_bits) allocation returned by indx_new(). For a 512-byte destination and a resident root whose non-last entries total 560 bytes, the memcpy overruns by 120 bytes and a following memmove extends the highest written offset to 136 bytes past the allocation. The overflow bytes are a direct copy of on-disk entries (via kmemdup), so they are fully attacker-controlled. The write is reachable from unprivileged open(O_CREAT) on a mounted crafted NTFS image: a single sufficiently long create in a directory whose resident root is already full forces root promotion and triggers the copy. This is a controlled out-of-bounds write of 120-136 bytes past a kmalloc(index_block_size) allocation, with attacker-controlled content. It is a bounded adjacent-heap corruption primitive; it is not an arbitrary-address write. Successful exploitation into a named victim object depends on the surrounding slab layout. Reject the copy at the sink. The destination's INDEX_HDR already reports hdr_total (the payload capacity of the new buffer) and hdr_used (the bytes already consumed by the terminal END entry installed by indx_new()); require that to_move fits in the remaining payload before calling hdr_insert_head(). On mismatch, fail with -EINVAL and mark the filesystem as having a detected on-disk inconsistency, which is the same behaviour as the surrounding validation in this function.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-17

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-72192

EUVD

EUVD-2026-58950

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a Linux kernel vulnerability in the NTFS3 filesystem driver. It involves an out-of-bounds write when handling crafted NTFS images. The issue occurs when a full resident $INDEX_ROOT is promoted to $INDEX_ALLOCATION and copied into a new buffer. A crafted image can shrink the buffer size while keeping the root full, causing a memcpy to write past the allocated memory. The overflow is 120-136 bytes with attacker-controlled content.

Detection Guidance

This vulnerability is specific to the Linux kernel's NTFS3 driver and requires a crafted NTFS image to trigger. Detection involves checking for unusual filesystem activity or corruption in NTFS partitions. Monitor kernel logs for errors related to NTFS operations or memory corruption. Use commands like dmesg | grep -i ntfs or journalctl -k | grep -i ntfs to check for NTFS-related errors.

Impact Analysis

An attacker could exploit this by creating a malicious NTFS image and tricking a user into mounting it. This could lead to memory corruption, crashes, or potentially arbitrary code execution on the system. The vulnerability is reachable from unprivileged operations like opening a file on the crafted filesystem.

Compliance Impact

This vulnerability is a controlled out-of-bounds write in the Linux kernel's NTFS3 driver, enabling heap corruption with attacker-controlled data. It does not directly impact compliance with standards like GDPR or HIPAA, which focus on data protection and privacy. However, if exploited, it could lead to unauthorized data access or system compromise, indirectly affecting compliance by violating data integrity or security requirements.

Mitigation Strategies

Apply the latest Linux kernel updates to patch this vulnerability. Avoid mounting untrusted NTFS images until the patch is applied. If immediate patching is not possible, restrict access to NTFS partitions or disable the NTFS3 driver if not required. Monitor vendor advisories for updates.

Hi! I’m here to help you understand CVE-2026-72192. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70