CVE-2026-72222

In the Linux kernel, the following vulnerability has been resolved: sunrpc: pin svcxprt across the asynchronous TLS handshake callback svctcphandshake stores the raw svcxprt pointer in tlshandshakeargs.tadata and submits the request through tlsserverhellox509. The handshake core takes only...

CVE-2026-72217 SUNRPC: Bound-check xdr_buf_to_bvec() stores before writing

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Bound-check xdrbuftobvec stores before writing xdrbuftobvec writes a biovec into the caller's array before testing whether that slot is in range, and the head branch performs the store with no check at all. When the...

CVE-2026-72217 SUNRPC: Bound-check xdr_buf_to_bvec() stores before writing

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Bound-check xdrbuftobvec stores before writing xdrbuftobvec writes a biovec into the caller's array before testing whether that slot is in range, and the head branch performs the store with no check at all. When the...

CVE-2026-72211

In the Linux kernel, the following vulnerability has been resolved: ntfs: grow index root value before reparent header update ntfsirreparent moves the resident index root entries into an index block and leaves a small root stub containing the child VCN. That root stub can be larger than the...

CVE-2026-72211 ntfs: grow index root value before reparent header update

In the Linux kernel, the following vulnerability has been resolved: ntfs: grow index root value before reparent header update ntfsirreparent moves the resident index root entries into an index block and leaves a small root stub containing the child VCN. That root stub can be larger than the...

CVE-2026-72211

The CVE concerns the Linux kernel NTFS handling in ntfs_ir_reparent(), where a root stub may grow beyond the resident index root value. The code can publish a larger index header (index_length/allocated_size) before resizing the resident value, so if a resize fails with ENOSPC, recovery paths may...

EUVD-2026-58968

In the Linux kernel, the following vulnerability has been resolved: ntfs: fix off-by-one in mapping pairs decoding bounds checks In ntfsmappingpairsdecompress, attrend points one byte past the end of the attribute record: attrend = u8 attr + le32tocpuattr-length; The two bounds checks validating...

CVE-2026-72208

CVE-2026-72208 affects the Linux kernel NTFS EA handling code. The vulnerability arises from insufficient bounds checking in ntfs_ea_lookup and ntfs_listxattr, where the code accesses the next_entry_offset field of an EA entry without verifying there is enough space. The issue is resolved in the ...

CVE-2026-72208 ntfs: add bounds check before accessing EA entries

In the Linux kernel, the following vulnerability has been resolved: ntfs: add bounds check before accessing EA entries in ntfsealookup and ntfslistxattr, this verifies that there is enough space in the EA entry before accessing the nextentryoffset field of the EA entry...

CVE-2026-72209

CVE-2026-72209 concerns the Linux kernel NTFS attribute value handling. The fix adds a shared attribute value validator and applies it before any lookup path can return an attribute (including AT_UNUSED). The validator enforces bounds for resident values, minimum resident sizes, checks variable-l...

CVE-2026-72208 ntfs: add bounds check before accessing EA entries

In the Linux kernel, the following vulnerability has been resolved: ntfs: add bounds check before accessing EA entries in ntfsealookup and ntfslistxattr, this verifies that there is enough space in the EA entry before accessing the nextentryoffset field of the EA entry...

EUVD-2026-58966

In the Linux kernel, the following vulnerability has been resolved: ntfs: add bounds check before accessing EA entries in ntfsealookup and ntfslistxattr, this verifies that there is enough space in the EA entry before accessing the nextentryoffset field of the EA entry...

CVE-2026-72206

The CVE-2026-72206 entry concerns the Linux kernel NTFS index block validation. A stricter validation was added for INDEX_HEADER geometry in INDX blocks via ntfs_index_block_inconsisent(), and ntfs_lookup_inode_by_name() was updated to use this validation. This fixes a vulnerability in how INDX b...

CVE-2026-72206 ntfs: validate index block header more strictly

In the Linux kernel, the following vulnerability has been resolved: ntfs: validate index block header more strictly Modify ntfsindexblockinconsisent to perform stricter validation of INDEXHEADER geometry in INDX blocks, and update ntfslookupinodebyname to use that function to validate INDX blocks...

EUVD-2026-58962

In the Linux kernel, the following vulnerability has been resolved: ntfs: centalize $INDEXROOT header validation Add a dedicated helper to perform stricter validation of $INDEXROOT and use it for both directory inodes and named index inodes. This keeps the root size and header geometry checks...

CVE-2026-72201

CVE-2026-72201 affects the Linux kernel NTFS implementation where index entries are validated after reading an index root or block. Root cause: insufficient immediate validation of index entries during lookup/readdir paths, leading to potential missed checks. The CVSS appears CRITICAL (Network, N...

CVE-2026-72201

In the Linux kernel, the following vulnerability has been resolved: ntfs: validate index entries on reading Validate index entries immediately after reading an index root or index block from disk. This eliminates repeated checks in lookup and readdir, and reduce the risk of missing checks in thos...

CVE-2026-72199

The CVE refers to the Linux kernel ntfs patch that validates resident index root values on lookup. The fix ensures 8-byte alignment of index header fields, sane entries_offset, index_length within allocated_size, and allocated_size consistency within the resident value, and it validates header in...

CVE-2026-72198 ntfs: reject non-resident records for resident-only attributes

In the Linux kernel, the following vulnerability has been resolved: ntfs: reject non-resident records for resident-only attributes The shared lookup-time attribute validator rejects non-resident $FILENAME and $VOLUMENAME records because their formats require resident values and callers handle...

CVE-2026-72197 fs/ntfs3: bound DeleteIndexEntryAllocation memmove length

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: bound DeleteIndexEntryAllocation memmove length In doaction's DeleteIndexEntryAllocation case, e-size comes from an on-disk INDEXBUFFER entry. When e-size makes e + e-size point past hdr + hdr-used, PtrOffsete1,...