EUVD-2026-49110

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: bound NTFSDE view.dataoff in UpdateRecordDataRoot,Allocation In doaction's UpdateRecordDataRoot fslog.c:3489 and UpdateRecordDataAllocation fslog.c:3697 cases, the memmove destination is Add2Ptre, le16tocpue-view.dataof...

CVE-2026-64432

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: validate Dirty Page Table capacity in logreplay copylcns In the analysis pass of $LogFile journal replay, logreplay copies LCNs from each action log record into an existing Dirty Page Table DPT entry without bounding th...

fs/ntfs3: terminate the cached volume label after UTF-8 conversion

...

SUSE CVE-2026-53027

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: fix missing run load for vcn0 in attrdatagetblocklocked When a compressed or sparse attribute has its clusters frame-aligned, vcn is rounded down to the frame start using cmask, which can result in vcn != vcn0. In this...

SUSE CVE-2026-53023

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: terminate the cached volume label after UTF-8 conversion ntfsfillsuper loads the on-disk volume label with utf16stoutf8s and stores the result in sbi-volume.label. The converted label is later exposed through...

CVE-2026-53023

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: terminate the cached volume label after UTF-8 conversion ntfsfillsuper loads the on-disk volume label with utf16stoutf8s and stores the result in sbi-volume.label. The converted label is later exposed through...

Astra Linux – Vulnerability in Linux 5.15

A flaw in the NULL Pointer Dereference mechanism within the Linux kernel’s NTFS3 driver function attrpunchhole was identified. A local user could exploit this flaw to crash the system...

Linux Distros Unpatched Vulnerability : CVE-2025-71311

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - fs/ntfs3: Initialize new folios before use KMSAN reports an uninitialized value in longestmatchstd, invoked from ntfscompresswrite. When new folios are allocate...

CVE-2026-45935 fs/ntfs3: Fix slab-out-of-bounds read in DeleteIndexEntryRoot

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Fix slab-out-of-bounds read in DeleteIndexEntryRoot In the 'DeleteIndexEntryRoot' case of the 'doaction' function, the entry size 'esize' is retrieved from the log record without adequate bounds checking. Specifically,...

Astra Linux – Vulnerability in ntfs-3g

A properly crafted NTFS image with an unallocated bitmap can lead to an endless recursive function call chain starting from ntfsattrpwrite, causing stack consumption in NTFS-3G 2021.8.22...

Astra Linux – Vulnerability in ntfs-3g

An invalid return code in fusekernmount allows for the interception of libfuse-lite protocol traffic between NTFS-3G and the kernel in NTFS-3G through 2021.8.22 when using libfuse-lite...

ALPINE-CVE-2026-40706

In NTFS-3G 2022.10.3 before 2026.2.25, a heap buffer overflow exists in ntfsbuildpermissionsposix in acls.c that allows an attacker to corrupt heap memory in the SUID-root ntfs-3g binary by crafting a malicious NTFS image. The overflow is triggered on the READ path stat, readdir, open when...

USN-8192-1 ntfs-3g vulnerabilities

Jeffrey Bencteux discovered that NTFS-3G incorrectly handled certain UTF-8 sequences. An attacker could use this issue to cause NTFS-3G to crash, resulting in a denial of service, or to execute arbitrary code. This issue only affected Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. CVE-2023-52890 Andrea...

[SECURITY] [DSA 6221-1] ntfs-3g security update

------------------------------------------------------------------------- Debian Security Advisory DSA-6221-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso April 21, 2026 https://www.debian.org/security/faq -...

USN-8180-2: Linux kernel (FIPS) vulnerabilities

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - ARM64 architecture; - Block layer subsystem; - Drivers core; - Bluetooth drivers; - DMA engine subsystem; - GPU...

Amazon Linux 2023 : bpftool6.12, kernel6.12, kernel6.12-devel (ALAS2023-2026-1543)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1543 advisory. In the Linux kernel, the following vulnerability has been resolved: fs/xattr: missing fdput in fremovexattr error path CVE-2024-14027 In the Linux kernel, the following vulnerability has been...

ROS-20260403-73-0039

A vulnerability in the fs/ntfs3/dir.c component of the Linux kernel is related to the use of memory after it has been freed. Exploitation of the vulnerability allows an attacker to cause a denial of service...

fs: ntfs3: fix infinite loop triggered by zero-sized ATTR_LIST

...

SUSE CVE-2025-71265

In the Linux kernel, the following vulnerability has been resolved: fs: ntfs3: fix infinite loop in attrloadrunsrange on inconsistent metadata We found an infinite loop bug in the ntfs3 file system that can lead to a Denial-of-Service DoS condition. A malformed NTFS image can cause an infinite lo...

RockyLinux 8 : virt:rhel and virt-devel:rhel (RLSA-2023:5264)

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2023:5264 advisory. QEMU: VNC: improper I/O watch removal in TLS handshake can lead to remote unauthenticated denial of service CVE-2023-3354 NTFS-3G: buffer overflow issue ...