CVE-2026-72192 ntfs3: bound to_move in indx_insert_into_root before hdr_insert_head

In the Linux kernel, the following vulnerability has been resolved: ntfs3: bound tomove in indxinsertintoroot before hdrinserthead indxinsertintoroot promotes a full resident $INDEXROOT into $INDEXALLOCATION and copies all non-last resident root entries into a newly allocated INDEXBUFFER via...

CVE-2026-72191 ntfs3: validate split-point offset in indx_insert_into_buffer

In the Linux kernel, the following vulnerability has been resolved: ntfs3: validate split-point offset in indxinsertintobuffer indxinsertintobuffer computes used = used1 - tocopy - spsize; memmovedet, Add2Ptrsp, spsize, used - le32tocpuhdr1-deoff; where sp and spsize come from hdrfindsplit...

EUVD-2026-58949

In the Linux kernel, the following vulnerability has been resolved: ntfs3: validate split-point offset in indxinsertintobuffer indxinsertintobuffer computes used = used1 - tocopy - spsize; memmovedet, Add2Ptrsp, spsize, used - le32tocpuhdr1-deoff; where sp and spsize come from hdrfindsplit...

CVE-2026-72191

CVE-2026-72191 (Linux kernel ntfs3): The issue arises in indx_insert_into_buffer where sp and sp_size from hdr_find_split() can cause an underflow when sp_size exceeds remaining buffer, producing an out-of-bounds write and kernel panic. Reports show a crafted NTFS image where interior NTFS_DE siz...

CVE-2026-72191 ntfs3: validate split-point offset in indx_insert_into_buffer

In the Linux kernel, the following vulnerability has been resolved: ntfs3: validate split-point offset in indxinsertintobuffer indxinsertintobuffer computes used = used1 - tocopy - spsize; memmovedet, Add2Ptrsp, spsize, used - le32tocpuhdr1-deoff; where sp and spsize come from hdrfindsplit...

PT-2026-72383

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: bound attr off in UpdateResidentValue against data off In do action's UpdateResidentValue case fslog.c:3307, lrh-attr off and lrh-redo len come from the on-disk LRH. When they satisfy aoff + dlen res.data off, the...

PT-2026-72382

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: add depth limit to indx find buffer to prevent stack overflow indx find buffer recursively descends the B+ tree index with no depth limit. A crafted NTFS image with circular index node references causes unbounded...

PT-2026-72381

In the Linux kernel, the following vulnerability has been resolved: ntfs3: cap RESTART TABLE free-chain walker at rt-used A crafted NTFS3 disk image triggers an in-kernel infinite loop at mount time, hanging the mounting thread and firing the soft-lockup watchdog within 22s on multi-CPU hosts pan...

PT-2026-72658

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: resize log-one page buf when adopting on-disk page size log replay allocates log-one page buf using the page size that was chosen from the host PAGE SIZE: log-one page buf = kmalloclog-page size, GFP NOFS; Later, when a...

PT-2026-72380

In the Linux kernel, the following vulnerability has been resolved: ntfs3: bound to move in indx insert into root before hdr insert head indx insert into root promotes a full resident $INDEX ROOT into $INDEX ALLOCATION and copies all non-last resident root entries into a newly allocated INDEX...

Linux Distros Unpatched Vulnerability : CVE-2026-72191

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ntfs3: validate split-point offset in indxinsertintobuffer indxinsertintobuffer computes used = used1 - tocopy - spsize; memmovedet, Add2Ptrsp, spsize, used -...

PT-2026-72659

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: prevent potential lcn remains uninitialized The target VCN being sought was not found within runs0, causing run lookup to return false. This causes run lookup entry to return false, which in turn results in a len value ...

PT-2026-72384

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: bound copy lcns dp-page lcns index in analysis pass In log replay's analysis pass, after find dp returns a valid DIR PAGE ENTRY for the target attr, target vcn tuple, the copy lcns block walks lrh-lcns follow further...

Linux Distros Unpatched Vulnerability : CVE-2026-72470

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - fs/ntfs3: resize log-onepagebuf when adopting on-disk page size logreplay allocates log-onepagebuf using the page size that was chosen from the host PAGESIZE:...

PT-2026-72379

In the Linux kernel, the following vulnerability has been resolved: ntfs3: validate split-point offset in indx insert into buffer indx insert into buffer computes used = used1 - to copy - sp size; memmovede t, Add2Ptrsp, sp size, used - le32 to cpuhdr1-de off; where sp and sp size come from hdr...

PT-2026-72385

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: bound DeleteIndexEntryAllocation memmove length In do action's DeleteIndexEntryAllocation case, e-size comes from an on-disk INDEX BUFFER entry. When e-size makes e + e-size point past hdr + hdr-used, PtrOffsete1,...

PT-2026-72666

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: add bounds check to run get highest vcn run get highest vcn parses a packed NTFS mapping-pairs buffer without any length bound, relying solely on a 0x00 terminator to stop. A crafted $LogFile UpdateMappingPairs record...

PT-2026-72665

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: call ntfs bad inode when failing to rename It is safe to call ntfs bad inode on live inodes since: commit 519b078998ce "fs/ntfs3: Exclude call make bad inode for live nodes." The WARN ON was added when it wasn't safe by...

The vulnerability of the ntfs3/attrlist.c component in the Linux operating system allows a hacker to cause a service failure.

The vulnerability of the ntfs3/attrlist.c component in the Linux operating system is related to the execution of a loop with an unreachable exit condition. Exploiting this vulnerability could allow an attacker to cause a service failure using corrupted NTFS images...

The vulnerability of the ntfs3/attrib.c component in the Linux operating system allows a hacker to trigger a service failure.

The vulnerability of the ntfs3/attrib.c component in the Linux operating system is related to the execution of a loop with an unreachable exit condition. Exploiting this vulnerability can allow an attacker to cause a service failure using corrupted NTFS images...