142 matches found
DEBIAN-CVE-2026-89614
In the Linux kernel, the following vulnerability has been resolved: ntfs: bound the free-cluster bitmap scan to the volume vol-lcnemptybitsperpage is sized from vol-nrclusters at mount, but ntfsclusteralloc bounds its scan of that array by the size of $Bitmap. Those are independent on-disk...
DEBIAN-CVE-2026-89611
In the Linux kernel, the following vulnerability has been resolved: ntfs: validate non-resident attribute offsets ntfsattrupdatemeta shifts the attribute name when converting between non-sparse and sparse attributes. Converting to sparse also adds the compressedsize field before the name and...
CVE-2026-89614
In the Linux kernel, the following vulnerability has been resolved: ntfs: bound the free-cluster bitmap scan to the volume vol-lcnemptybitsperpage is sized from vol-nrclusters at mount, but ntfsclusteralloc bounds its scan of that array by the size of $Bitmap. Those are independent on-disk...
UBUNTU-CVE-2026-89613
In the Linux kernel, the following vulnerability has been resolved: ntfs: reject invalid empty mapping pairs Reject an attribute with empty mapping pairs if it has inconsistent highest VCN and size...
CVE-2026-89613
In the Linux kernel, the following vulnerability has been resolved: ntfs: reject invalid empty mapping pairs Reject an attribute with empty mapping pairs if it has inconsistent highest VCN and size...
UBUNTU-CVE-2026-89610
In the Linux kernel, the following vulnerability has been resolved: ntfs: verify run length exceeding volume boundary The mapping pairs decoder validates that the starting LCN is within the volume but does not check if the run extends beyond the volume boundary. A malformed NTFS image with a...
CVE-2026-89613 ntfs: reject invalid empty mapping pairs
In the Linux kernel, the following vulnerability has been resolved: ntfs: reject invalid empty mapping pairs Reject an attribute with empty mapping pairs if it has inconsistent highest VCN and size...
CVE-2026-89613 ntfs: reject invalid empty mapping pairs
In the Linux kernel, the following vulnerability has been resolved: ntfs: reject invalid empty mapping pairs Reject an attribute with empty mapping pairs if it has inconsistent highest VCN and size...
CVE-2026-89614 ntfs: bound the free-cluster bitmap scan to the volume
In the Linux kernel, the following vulnerability has been resolved: ntfs: bound the free-cluster bitmap scan to the volume vol-lcnemptybitsperpage is sized from vol-nrclusters at mount, but ntfsclusteralloc bounds its scan of that array by the size of $Bitmap. Those are independent on-disk...
CVE-2026-89614
CVE-2026-89614 affects the Linux kernel's NTFS file system driver . The flaw is in ntfs_cluster_alloc(), which bounds its free-cluster bitmap scan by the size of the on-disk $Bitmap rather than by the volume's actual cluster count (nr_clusters). Because these are independent quantities, a special...
EUVD-2026-76526
In the Linux kernel, the following vulnerability has been resolved: ntfs: bound the free-cluster bitmap scan to the volume vol-lcnemptybitsperpage is sized from vol-nrclusters at mount, but ntfsclusteralloc bounds its scan of that array by the size of $Bitmap. Those are independent on-disk...
CVE-2026-89612 ntfs: reject invalid MFT LCNs from boot sector
In the Linux kernel, the following vulnerability has been resolved: ntfs: reject invalid MFT LCNs from boot sector The NTFS boot sector stores the MFT and MFTMirr locations as unsigned 64-bit LCNs, but parsentfsbootsector decoded them into an s64. A crafted high-bit value could therefore become...
CVE-2026-89612 ntfs: reject invalid MFT LCNs from boot sector
In the Linux kernel, the following vulnerability has been resolved: ntfs: reject invalid MFT LCNs from boot sector The NTFS boot sector stores the MFT and MFTMirr locations as unsigned 64-bit LCNs, but parsentfsbootsector decoded them into an s64. A crafted high-bit value could therefore become...
CVE-2026-89611
In the Linux kernel, the following vulnerability has been resolved: ntfs: validate non-resident attribute offsets ntfsattrupdatemeta shifts the attribute name when converting between non-sparse and sparse attributes. Converting to sparse also adds the compressedsize field before the name and...
EUVD-2026-76523
In the Linux kernel, the following vulnerability has been resolved: ntfs: validate non-resident attribute offsets ntfsattrupdatemeta shifts the attribute name when converting between non-sparse and sparse attributes. Converting to sparse also adds the compressedsize field before the name and...
CVE-2026-89610
CVE-2026-89610 affects the Linux kernel NTFS subsystem . The mapping pairs decoder validates that the starting LCN is within the volume but fails to check whether the run length extends beyond the volume boundary. A malformed NTFS image with a crafted mapping pairs array can cause the kernel to a...
PT-2026-90327
In the Linux kernel, the following vulnerability has been resolved: ntfs: validate non-resident attribute offsets ntfs attr update meta shifts the attribute name when converting between non-sparse and sparse attributes. Converting to sparse also adds the compressed size field before the name and...
SUSE CVE-2026-80869
In the Linux kernel, the following vulnerability has been resolved: ntfs: bound the attribute-list entry in ntfsreadinodemount The $MFT attribute-list walk in ntfsreadinodemount validates each entry only with "u8 alentry + 6 alend" and "u8 alentry + le16tocpualentry-length alend", but then reads...
SUSE CVE-2026-80673
In the Linux kernel, the following vulnerability has been resolved: ntfs: bound the look-ahead attribute-list entry in ntfsexternalattrfind When resolving an attribute lookup with a non-zero @lowestvcn, ntfsexternalattrfind peeks at the next $ATTRIBUTELIST entry to decide whether to keep searchin...
UBUNTU-CVE-2026-80673
In the Linux kernel, the following vulnerability has been resolved: ntfs: bound the look-ahead attribute-list entry in ntfsexternalattrfind When resolving an attribute lookup with a non-zero @lowestvcn, ntfsexternalattrfind peeks at the next $ATTRIBUTELIST entry to decide whether to keep searchin...