CVE-2026-97437
Received Received - Intake

Out-of-Bounds Read in Linux Kernel NTFS3 Filesystem

Publication date: 2026-09-24

Last updated on: 2026-09-24

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: ntfs3: fix out-of-bounds read in ntfs_dir_emit() and hdr_find_e() The bounds check in ntfs_dir_emit() compares fname->name_len (a character count) against e->size (a byte count) without accounting for the 2-byte-per-character UTF-16LE encoding or the ATTR_FILE_NAME header size: if (fname->name_len + sizeof(struct NTFS_DE) > le16_to_cpu(e->size)) This computes: name_len + 16 > e_size The correct check must account for the ATTR_FILE_NAME header (66 bytes before the name) and the UTF-16LE character size (2 bytes each): sizeof(NTFS_DE) + offsetof(ATTR_FILE_NAME, name) + name_len * sizeof(short) > e_size Which computes: 16 + 66 + name_len * 2 > e_size The correct calculation already exists as fname_full_size() in ntfs.h and is used in cmp_fnames(), namei.c, and fslog.c, but was not used in the readdir path. A crafted NTFS image with an index entry containing a small e->size but large fname->name_len bypasses the current check, causing ntfs_utf16_to_nls() to read past the entry boundary. Additionally, add a key_size validation in hdr_find_e() to ensure the declared key_size does not exceed the available entry data, preventing comparison functions from reading past entry boundaries on the lookup path.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-24
Last Modified
2026-09-24
Generated
2026-09-24
AI Q&A
2026-09-24
EPSS Evaluated
N/A
NVD
CVE-2026-97437
EUVD
EUVD-2026-86050

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is in the Linux kernel's NTFS3 file system driver. It involves an out-of-bounds read in two functions: ntfs_dir_emit() and hdr_find_e(). The issue occurs because the bounds check in ntfs_dir_emit() incorrectly compares a character count (fname->name_len) against a byte count (e->size) without accounting for UTF-16LE encoding (2 bytes per character) or the ATTR_FILE_NAME header size. This allows a crafted NTFS image to bypass the check and cause the driver to read memory outside the intended entry boundary.

Detection Guidance

This vulnerability affects the Linux kernel's NTFS3 filesystem driver. Detection requires checking kernel versions and filesystem usage. Inspect loaded kernel modules with lsmod | grep ntfs3. Verify kernel version with uname -r. Check for NTFS3 mounts using mount | grep ntfs. If affected, update the kernel immediately.

Impact Analysis

This vulnerability could allow an attacker with access to a crafted NTFS filesystem to cause a denial of service (system crash) or potentially execute arbitrary code on the affected system. It may also lead to data corruption or unauthorized access to sensitive information if exploited.

Mitigation Strategies

Update the Linux kernel to the latest patched version. Avoid mounting untrusted NTFS filesystems until patched. If immediate patching is not possible, disable NTFS3 support by blacklisting the module or recompiling the kernel without NTFS3 support.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-97437. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart