CVE-2026-72195

Received Received - Intake

Integer Underflow in Linux Kernel NTFS3 Filesystem

Publication date: 2026-08-15

Last updated on: 2026-08-17

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: bound attr_off in UpdateResidentValue against data_off In do_action()'s UpdateResidentValue case (fslog.c:3307), lrh->attr_off and lrh->redo_len come from the on-disk LRH. When they satisfy aoff + dlen < attr->res.data_off, the assignment attr->res.data_size = cpu_to_le32(aoff + dlen - data_off); underflows to ~4 GiB (e.g. 0xFFFFFFF9 when aoff=0x10, dlen=1, data_off=0x18). Subsequent code that reads attr->res.data_size to walk the resident attribute payload would then read up to 4 GiB past the 1024-byte MFT record allocation. The existing mi_enum_attr() defense in fs/ntfs3/record.c:287 catches the corrupted data_size on the next attribute walk and fails the mount, but only on the path that walks all attributes. A read site that picks an attribute by name and reads its data_size without re-validating is not covered. Validate aoff against data_off and asize at the source. Reproduced under UML+KASAN on mainline 8d90b09e6741 via pr_warn-only probe: with aoff=0x10 and data_off=0x18, the post-assignment data_size is 0xfffffff9 (mount then fails at -22 from mi_enum_attr). [almaz.alexandrovich@paragon-software.com: clang-formatted the changes]

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-17

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-72195

EUVD

EUVD-2026-58953

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	From 8d90b09e6741 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability is in the Linux kernel's NTFS3 file system driver. It involves a calculation error in the UpdateResidentValue function where an underflow occurs when processing attribute offsets and data lengths. This leads to an incorrect data_size value that could cause the system to read up to 4 GiB past the allocated memory during attribute payload processing.

Detection Guidance

This vulnerability is specific to the Linux kernel's NTFS3 filesystem implementation and requires kernel-level inspection. Detection involves checking for kernel crashes, filesystem corruption, or KASAN warnings related to NTFS3 operations. Monitor kernel logs for errors like 'mi_enum_attr' failures or invalid memory accesses in fs/ntfs3. No direct network detection commands are applicable.

Impact Analysis

This vulnerability could allow an attacker to cause a denial of service by crashing the system or potentially execute arbitrary code with kernel privileges. It may also lead to data corruption or unauthorized access to sensitive information stored on NTFS file systems.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it pertains to a specific filesystem (NTFS3) in the Linux kernel. Compliance risks would arise only if the vulnerability leads to unauthorized data access or corruption, which is not described in the provided context.

Mitigation Strategies

Apply the latest Linux kernel patches that address this issue. Avoid using the NTFS3 filesystem until patched. If NTFS3 is required, consider using alternative filesystems like NTFS-3G in FUSE mode. Monitor vendor advisories for kernel updates.

Hi! I’m here to help you understand CVE-2026-72195. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70