Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: ntfs3: Boundary checks for the buffer were added to rununpack. rununpack checks runbuf runlast at the beginning of the while loop. However, it then reads sizesize and offsetsize bytes via rununpacks64, without verifying that thes...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Rejects restart table growth that exceeds U16MAX entries. During $LogFile replay, logreplay indexes the transaction table using the transactid obtained from the log record header. checklogrec only verifies that transact...

CVE-2026-42618

In NTFS-3G before 2026.7.7, a heap buffer overflow exists in ntfsdecompress in compress.c that allows an attacker to corrupt one byte of heap memory in the SUID-root ntfs-3g binary by crafting a malicious NTFS image. The overflow is triggered by reading the special crafted file...

CVE-2026-42616: Out-of-bounds Write

In NTFS-3G before 2026.7.7, a heap buffer overflow exists in cat in ntfscat.c that allows an attacker to corrupt heap memory in the ntfscat binary by crafting a malicious NTFS image. The overflow is triggered by reading a file...

CVE-2026-42618

In NTFS-3G before 2026.7.7, a heap buffer overflow exists in ntfsdecompress in compress.c that allows an attacker to corrupt one byte of heap memory in the SUID-root ntfs-3g binary by crafting a malicious NTFS image. The overflow is triggered by reading the special crafted file...

CVE-2026-42617

In NTFS-3G before 2026.7.7, a heap buffer overflow exists in ntfsirtoib in index.c that allows an attacker to corrupt heap memory in the SUID-root ntfs-3g binary by crafting a malicious NTFS image. The overflow is triggered by extending a directory, e.g., by creating a file...

Astra Linux – Vulnerability in ntfs-3g

A properly crafted NTFS image with an unallocated bitmap can lead to an endless recursive function call chain starting from ntfsattrpwrite, causing stack consumption in NTFS-3G 2021.8.22...

Astra Linux – Vulnerability in ntfs-3g

A properly crafted NTFS image can lead to a out-of-bounds read, caused by an invalid attribute in ntfsattrfindinattrdef, in NTFS-3G 2021.8.22...

Astra Linux – Vulnerability in ntfs-3g

A properly crafted NTFS image can cause an integer overflow in the memmove function, resulting in a heap-based buffer overflow in the ntfsattrrecordresize function, as of NTFS-3G version 2021.8.22...

Astra Linux – Vulnerability in ntfs-3g

A properly crafted NTFS image can lead to heap exhaustion in ntfsgetattributevalue in NTFS-3G from version 2021.8.22 onwards...

Astra Linux – Vulnerability in ntfs-3g

In NTFS-3G versions before version 2021.8.22, when a specially crafted Unicode string is provided in an NTFS image, a heap buffer overflow may occur, allowing code execution...

CVE-2026-97437

In the Linux kernel, the following vulnerability has been resolved: ntfs3: fix out-of-bounds read in ntfsdiremit and hdrfinde The bounds check in ntfsdiremit compares fname-namelen a character count against e-size a byte count without accounting for the 2-byte-per-character UTF-16LE encoding or t...

CVE-2026-97437 ntfs3: fix out-of-bounds read in ntfs_dir_emit() and hdr_find_e()

In the Linux kernel, the following vulnerability has been resolved: ntfs3: fix out-of-bounds read in ntfsdiremit and hdrfinde The bounds check in ntfsdiremit compares fname-namelen a character count against e-size a byte count without accounting for the 2-byte-per-character UTF-16LE encoding or t...

EUVD-2026-86050

In the Linux kernel, the following vulnerability has been resolved: ntfs3: fix out-of-bounds read in ntfsdiremit and hdrfinde The bounds check in ntfsdiremit compares fname-namelen a character count against e-size a byte count without accounting for the 2-byte-per-character UTF-16LE encoding or t...

CVE-2026-97437: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: ntfs3: fix out-of-bounds read in ntfsdiremit and hdrfinde The bounds check in ntfsdiremit compares fname-namelen a character count against e-size a byte count without accounting for the 2-byte-per-character UTF-16LE encoding or t...

CVE-2026-90048 fs/ntfs3: fix slab-out-of-bounds write in ni_create_attr_list()

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: fix slab-out-of-bounds write in nicreateattrlist nicreateattrlist allocates a fixed buffer of alalignedrecordsize == recordsize bytes and then walks every attribute of the primary MFT record, writing one ATTRLISTENTRY p...

CVE-2026-90048

CVE-2026-90048 is a slab-out-of-bounds write in the Linux kernel's ntfs3 filesystem driver, specifically in ni_create_attr_list(). The function allocates a fixed-size buffer based on record_size and writes one ATTR_LIST_ENTRY per attribute without bounds checking. Since a minimum-size resident at...

CVE-2026-90048 fs/ntfs3: fix slab-out-of-bounds write in ni_create_attr_list()

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: fix slab-out-of-bounds write in nicreateattrlist nicreateattrlist allocates a fixed buffer of alalignedrecordsize == recordsize bytes and then walks every attribute of the primary MFT record, writing one ATTRLISTENTRY p...

EUVD-2026-80656

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: fix slab-out-of-bounds write in nicreateattrlist nicreateattrlist allocates a fixed buffer of alalignedrecordsize == recordsize bytes and then walks every attribute of the primary MFT record, writing one ATTRLISTENTRY p...

DEBIAN-CVE-2026-89781

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: fix out-of-bounds read in readlogrecbuf readlogrecbuf copies a log record into a caller buffer starting at u32 off = lsntopageofflog, lsn + log-recordheaderlen; log-recordheaderlen and log-dataoff, used for the followin...