CVE-2026-74570

In the Linux kernel, the following vulnerability has been resolved: ntfs: harden runlist realloc size calculations Add a shared helper to safely convert runlist element counts to byte sizes using overflow checks, and use it in both ntfsrlrealloc and ntfsrlreallocnofail...

CVE-2026-72470

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: resize log-onepagebuf when adopting on-disk page size logreplay allocates log-onepagebuf using the page size that was chosen from the host PAGESIZE: log-onepagebuf = kmalloclog-pagesize, GFPNOFS; Later, when a restart...

CVE-2026-72354

In the Linux kernel, the following vulnerability has been resolved: ntfs: avoid stale runlist element dereference in MFT writeback ntfswritemftblock maps each $MFT record through the $MFT data runlist. For sub-folio clusters it looks up a struct runlistelement under ni-runlist.lock, drops the loc...

CVE-2026-72353

In the Linux kernel, the following vulnerability has been resolved: ntfs: avoid stale runlist element dereference in fallocate ntfsattrfallocate allocates holes and delayed allocations inside initialized size by looking up the current runlist element under ni-runlist.lock. The returned struct...

UBUNTU-CVE-2026-72470

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: resize log-onepagebuf when adopting on-disk page size logreplay allocates log-onepagebuf using the page size that was chosen from the host PAGESIZE: log-onepagebuf = kmalloclog-pagesize, GFPNOFS; Later, when a restart...

UBUNTU-CVE-2026-72353

In the Linux kernel, the following vulnerability has been resolved: ntfs: avoid stale runlist element dereference in fallocate ntfsattrfallocate allocates holes and delayed allocations inside initialized size by looking up the current runlist element under ni-runlist.lock. The returned struct...

UBUNTU-CVE-2026-72354

In the Linux kernel, the following vulnerability has been resolved: ntfs: avoid stale runlist element dereference in MFT writeback ntfswritemftblock maps each $MFT record through the $MFT data runlist. For sub-folio clusters it looks up a struct runlistelement under ni-runlist.lock, drops the loc...

CVE-2026-72207

In the Linux kernel, the following vulnerability has been resolved: ntfs: not change 0-byte $DATA attribute to non-resident When ntfsresidentattrresize cannot grow a resident attribute in place, it retries after converting other resident attributes to non-resident to free space in the MFT recrord...

CVE-2026-72209

In the Linux kernel, the following vulnerability has been resolved: ntfs: validate attribute values on lookup ntfsattrfind and ntfsexternalattrfind check that generic resident attribute values fit in their attribute records and that fixed-size resident values are large enough. For variable-length...

CVE-2026-72204

In the Linux kernel, the following vulnerability has been resolved: ntfs: centalize $INDEXROOT header validation Add a dedicated helper to perform stricter validation of $INDEXROOT and use it for both directory inodes and named index inodes. This keeps the root size and header geometry checks...

CVE-2026-72206

In the Linux kernel, the following vulnerability has been resolved: ntfs: validate index block header more strictly Modify ntfsindexblockinconsisent to perform stricter validation of INDEXHEADER geometry in INDX blocks, and update ntfslookupinodebyname to use that function to validate INDX blocks...

CVE-2026-72208

In the Linux kernel, the following vulnerability has been resolved: ntfs: add bounds check before accessing EA entries in ntfsealookup and ntfslistxattr, this verifies that there is enough space in the EA entry before accessing the nextentryoffset field of the EA entry...

CVE-2026-72210

In the Linux kernel, the following vulnerability has been resolved: ntfs: fix off-by-one in mapping pairs decoding bounds checks In ntfsmappingpairsdecompress, attrend points one byte past the end of the attribute record: attrend = u8 attr + le32tocpuattr-length; The two bounds checks validating...

CVE-2026-72211

In the Linux kernel, the following vulnerability has been resolved: ntfs: grow index root value before reparent header update ntfsirreparent moves the resident index root entries into an index block and leaves a small root stub containing the child VCN. That root stub can be larger than the...

CVE-2026-72205

In the Linux kernel, the following vulnerability has been resolved: ntfs: free volume-wide resources on fillsuper failure ntfsfillsuper's erroutnow path frees only the volume struct via kfreevol, leaving several vol-owned allocations behind on every mount failure: - vol-nlsmap, loaded by...

CVE-2026-72202

In the Linux kernel, the following vulnerability has been resolved: ntfs: avoid heap allocation for free-cluster readahead state getnrfreeclusters allocates a temporary filerastate before it publishes the precomputed free cluster count, sets NVolFreeClusterKnown, and wakes vol-freewaitq. If that...

CVE-2026-72199

In the Linux kernel, the following vulnerability has been resolved: ntfs: validate resident index root values on lookup Resident $INDEXROOT values carry index header fields that callers consume after lookup. Some callers already validate parts of the layout before walking entries, but those check...

CVE-2026-72203

In the Linux kernel, the following vulnerability has been resolved: ntfs: skip extent mft records in writeback to prevent deadlock This patch fixes the ABBA deadlock between extentlock and extent mreclock triggered by xfstests generic/113, that occurs since the commit 6994acf33bae "ntfs: use base...

CVE-2026-72197

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: bound DeleteIndexEntryAllocation memmove length In doaction's DeleteIndexEntryAllocation case, e-size comes from an on-disk INDEXBUFFER entry. When e-size makes e + e-size point past hdr + hdr-used, PtrOffsete1,...

CVE-2026-72200

In the Linux kernel, the following vulnerability has been resolved: ntfs: detect mapping-pairs LCN accumulator overflow The NTFS mapping-pairs parser accumulates relative LCN deltas in a signed integer. A corrupted attribute can drive that addition past the representable range. One corrupt runlis...