CVE-2026-72354

In the Linux kernel, the following vulnerability has been resolved: ntfs: avoid stale runlist element dereference in MFT writeback ntfswritemftblock maps each $MFT record through the $MFT data runlist. For sub-folio clusters it looks up a struct runlistelement under ni-runlist.lock, drops the loc...

CVE-2026-72207

In the Linux kernel, the following vulnerability has been resolved: ntfs: not change 0-byte $DATA attribute to non-resident When ntfsresidentattrresize cannot grow a resident attribute in place, it retries after converting other resident attributes to non-resident to free space in the MFT recrord...

CVE-2026-72203

In the Linux kernel, the following vulnerability has been resolved: ntfs: skip extent mft records in writeback to prevent deadlock This patch fixes the ABBA deadlock between extentlock and extent mreclock triggered by xfstests generic/113, that occurs since the commit 6994acf33bae "ntfs: use base...

CVE-2026-72188

In the Linux kernel, the following vulnerability has been resolved: ntfs: sanitize MFT references returned from ntfslookupinodebyname ntfslookupinodebyname returns MFT references read from directory index entries on disk. These values are untrusted, but the function can currently return an...

CVE-2026-72354 ntfs: avoid stale runlist element dereference in MFT writeback

In the Linux kernel, the following vulnerability has been resolved: ntfs: avoid stale runlist element dereference in MFT writeback ntfswritemftblock maps each $MFT record through the $MFT data runlist. For sub-folio clusters it looks up a struct runlistelement under ni-runlist.lock, drops the loc...

EUVD-2026-59253

In the Linux kernel, the following vulnerability has been resolved: ntfs: avoid stale runlist element dereference in MFT writeback ntfswritemftblock maps each $MFT record through the $MFT data runlist. For sub-folio clusters it looks up a struct runlistelement under ni-runlist.lock, drops the loc...

EUVD-2026-58969

In the Linux kernel, the following vulnerability has been resolved: ntfs: grow index root value before reparent header update ntfsirreparent moves the resident index root entries into an index block and leaves a small root stub containing the child VCN. That root stub can be larger than the...

EUVD-2026-58967

In the Linux kernel, the following vulnerability has been resolved: ntfs: validate attribute values on lookup ntfsattrfind and ntfsexternalattrfind check that generic resident attribute values fit in their attribute records and that fixed-size resident values are large enough. For variable-length...

CVE-2026-72207 ntfs: not change 0-byte $DATA attribute to non-resident

In the Linux kernel, the following vulnerability has been resolved: ntfs: not change 0-byte $DATA attribute to non-resident When ntfsresidentattrresize cannot grow a resident attribute in place, it retries after converting other resident attributes to non-resident to free space in the MFT recrord...

EUVD-2026-58965

In the Linux kernel, the following vulnerability has been resolved: ntfs: not change 0-byte $DATA attribute to non-resident When ntfsresidentattrresize cannot grow a resident attribute in place, it retries after converting other resident attributes to non-resident to free space in the MFT recrord...

EUVD-2026-58953

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: bound attroff in UpdateResidentValue against dataoff In doaction's UpdateResidentValue case fslog.c:3307, lrh-attroff and lrh-redolen come from the on-disk LRH. When they satisfy aoff + dlen res.dataoff, the assignment...

CVE-2026-72188 ntfs: sanitize MFT references returned from ntfs_lookup_inode_by_name()

In the Linux kernel, the following vulnerability has been resolved: ntfs: sanitize MFT references returned from ntfslookupinodebyname ntfslookupinodebyname returns MFT references read from directory index entries on disk. These values are untrusted, but the function can currently return an...

EUVD-2026-58946

In the Linux kernel, the following vulnerability has been resolved: ntfs: sanitize MFT references returned from ntfslookupinodebyname ntfslookupinodebyname returns MFT references read from directory index entries on disk. These values are untrusted, but the function can currently return an...

PT-2026-72383

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: bound attr off in UpdateResidentValue against data off In do action's UpdateResidentValue case fslog.c:3307, lrh-attr off and lrh-redo len come from the on-disk LRH. When they satisfy aoff + dlen res.data off, the...

PT-2026-72542

In the Linux kernel, the following vulnerability has been resolved: ntfs: avoid stale runlist element dereference in MFT writeback ntfs write mft block maps each $MFT record through the $MFT data runlist. For sub-folio clusters it looks up a struct runlist element under ni-runlist.lock, drops the...

PT-2026-72391

In the Linux kernel, the following vulnerability has been resolved: ntfs: skip extent mft records in writeback to prevent deadlock This patch fixes the ABBA deadlock between extent lock and extent mrec lock triggered by xfstests generic/113, that occurs since the commit 6994acf33bae "ntfs: use ba...

PT-2026-72376

In the Linux kernel, the following vulnerability has been resolved: ntfs: sanitize MFT references returned from ntfs lookup inode by name ntfs lookup inode by name returns MFT references read from directory index entries on disk. These values are untrusted, but the function can currently return a...

PT-2026-72395

In the Linux kernel, the following vulnerability has been resolved: ntfs: not change 0-byte $DATA attribute to non-resident When ntfs resident attr resize cannot grow a resident attribute in place, it retries after converting other resident attributes to non-resident to free space in the MFT...

EUVD-2026-46911

Vulnerability in the Oracle Managed File Transfer product of Oracle Fusion Middleware component: MFT Runtime Server. Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracl...

CVE-2026-60549

Vulnerability in the Oracle Managed File Transfer product of Oracle Fusion Middleware component: MFT Runtime Server. Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracl...