CVE-2026-72478

Received Received - Intake

Buffer Boundary Check Bypass in Linux Kernel NTFS3

Publication date: 2026-08-15

Last updated on: 2026-08-17

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: add bounds check to run_get_highest_vcn() run_get_highest_vcn() parses a packed NTFS mapping-pairs buffer without any length bound, relying solely on a 0x00 terminator to stop. A crafted $LogFile UpdateMappingPairs record whose embedded attribute contains mapping-pairs runs without a terminator causes the function to read past the slab allocation, triggering a KASAN slab-out-of-bounds read on mount. The sibling function run_unpack() received an analogous bounds-check in commit b62567bca474 ("ntfs3: add buffer boundary checks to run_unpack()"), but run_get_highest_vcn() was missed. Take a run_buf_size parameter and reject any run header whose payload would extend past the buffer end, mirroring the pattern used by run_unpack(). The caller in fslog.c passes the remaining attribute bytes after the mapping-pairs offset. KASAN report (on mainline v7.1 merge window HEAD): BUG: KASAN: slab-out-of-bounds in run_get_highest_vcn+0x3c0/0x410 Read of size 1 at addr ffff88800e2d5400 by task mount/72 Call Trace: run_get_highest_vcn+0x3c0/0x410 do_action.isra.0+0x3ba8/0x7b50 log_replay+0x9ddd/0x10200 ntfs_loadlog_and_replay+0x4ad/0x610 ntfs_fill_super+0x214a/0x4540

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-17

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-72478

EUVD

EUVD-2026-59377

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability is in the Linux kernel's NTFS3 filesystem driver. The function run_get_highest_vcn() parses NTFS mapping-pairs buffers without checking their length, relying only on a terminator byte to stop. A crafted $LogFile record with missing terminators can cause the function to read past allocated memory, triggering a KASAN slab-out-of-bounds read when mounting the filesystem.

Detection Guidance

This vulnerability is specific to the Linux kernel's NTFS3 filesystem driver and requires examining kernel logs or running specific commands to detect signs of exploitation or crashes related to slab-out-of-bounds reads during NTFS mount operations.

Impact Analysis

An attacker could exploit this to cause a denial-of-service by crashing the system or potentially read sensitive kernel memory. It requires a specially crafted filesystem image to trigger, so normal file operations are not affected unless malicious data is mounted.

Compliance Impact

This vulnerability could impact compliance by enabling unauthorized access to kernel memory, potentially exposing sensitive data. Organizations handling regulated data (e.g., personal health or financial information) may face increased risk of breaches, requiring immediate patching to maintain compliance with standards like GDPR or HIPAA.

Mitigation Strategies

Apply the latest Linux kernel patches that include the fix for this vulnerability. If patching is not immediately possible, avoid mounting untrusted NTFS filesystems until the patch is applied to prevent potential exploitation.

Hi! I’m here to help you understand CVE-2026-72478. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70