CVE-2026-72196
Received Received - Intake

Buffer Overflow in Linux Kernel NTFS3 Filesystem

Publication date: 2026-08-15

Last updated on: 2026-08-15

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: bound copy_lcns dp->page_lcns[] index in analysis pass In log_replay()'s analysis pass, after find_dp() returns a valid DIR_PAGE_ENTRY for the (target_attr, target_vcn) tuple, the copy_lcns block walks lrh->lcns_follow further entries: t16 = le16_to_cpu(lrh->lcns_follow); for (i = 0; i < t16; i++) { size_t j = (size_t)(le64_to_cpu(lrh->target_vcn) - le64_to_cpu(dp->vcn)); dp->page_lcns[j + i] = lrh->page_lcns[i]; } find_dp() only validates that target_vcn falls within [dp->vcn, dp->vcn + dp->lcns_follow), i.e., that the FIRST cluster is covered. The walk through the further entries is not bounded against dp->lcns_follow. For a malformed LRH where target_vcn = dp->vcn + dp->lcns_follow - 1 and lrh->lcns_follow > 1, the i > 0 writes overflow the dp's allocated page_lcns[] array. Add the missing j + lrh->lcns_follow <= dp->lcns_follow guard. Reproduced under UML+KASAN on mainline 8d90b09e6741 as a slab-out-of-bounds write of size 8 from log_replay+0x68d4 on the mount path. This is distinct from Pavitra Jha's 2026-05-02 patch ("fs/ntfs3: validate lcns_follow in log_replay conversion", <20260502154252.164586-1-jhapavitra98@gmail.com>) which addresses the separate version-0 dirty-page-table conversion path's memmove(&dp->vcn, ...) call. The two fixes are complementary; both should land. [almaz.alexandrovich@paragon-software.com: clang-formatted the changes, fixed conflicts]

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-15
Last Modified
2026-08-15
Generated
2026-08-15
AI Q&A
2026-08-15
EPSS Evaluated
N/A
NVD
CVE-2026-72196
EUVD
EUVD-2026-58954

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
paragon_software ntfs3 *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Linux kernel vulnerability in the NTFS3 filesystem driver. It involves an out-of-bounds write in the log_replay function during filesystem analysis. The issue occurs when processing directory page entries where the code writes beyond the allocated memory for the page_lcns array due to missing bounds checking.

Detection Guidance

This vulnerability is specific to the Linux kernel's NTFS3 filesystem implementation and requires kernel-level detection. It involves a slab-out-of-bounds write during NTFS3 log replay operations. Detection typically involves kernel logging (dmesg) for slab errors or KASAN (Kernel Address Sanitizer) reports during filesystem operations. No direct network detection commands are applicable.

Impact Analysis

This vulnerability could allow an attacker to corrupt kernel memory, potentially leading to system crashes, privilege escalation, or arbitrary code execution. It specifically affects systems using the NTFS3 filesystem when mounting or accessing corrupted NTFS volumes.

Mitigation Strategies

Apply the kernel patch provided by the Linux kernel maintainers for CVE-2026-72196. Update to a patched kernel version that includes the fix for the NTFS3 log_replay() slab-out-of-bounds write. Disable or unmount NTFS3 filesystems if immediate patching is not possible.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-72196. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart