UBUNTU-CVE-2026-72204

In the Linux kernel, the following vulnerability has been resolved: ntfs: centalize $INDEXROOT header validation Add a dedicated helper to perform stricter validation of $INDEXROOT and use it for both directory inodes and named index inodes. This keeps the root size and header geometry checks...

UBUNTU-CVE-2026-72185

In the Linux kernel, the following vulnerability has been resolved: ntfs: fix WARNON for resident attribute in ntfsmaprunlistnolock When ntfsmaprunlistnolock needs to look up the attribute extent containing a target VCN ctxneedsreset == true, it calls ntfsattrlookup and then expects the result to...

UBUNTU-CVE-2026-72203

In the Linux kernel, the following vulnerability has been resolved: ntfs: skip extent mft records in writeback to prevent deadlock This patch fixes the ABBA deadlock between extentlock and extent mreclock triggered by xfstests generic/113, that occurs since the commit 6994acf33bae "ntfs: use base...

UBUNTU-CVE-2026-72201

In the Linux kernel, the following vulnerability has been resolved: ntfs: validate index entries on reading Validate index entries immediately after reading an index root or index block from disk. This eliminates repeated checks in lookup and readdir, and reduce the risk of missing checks in thos...

UBUNTU-CVE-2026-72188

In the Linux kernel, the following vulnerability has been resolved: ntfs: sanitize MFT references returned from ntfslookupinodebyname ntfslookupinodebyname returns MFT references read from directory index entries on disk. These values are untrusted, but the function can currently return an...

UBUNTU-CVE-2026-72184

In the Linux kernel, the following vulnerability has been resolved: ntfs: fix hole runlist memory leak in insert range error path ntfsnonresidentattrinsertrange allocates holerl before mapping the whole runlist. If ntfsattrmapwholerunlist fails, the error path drops ni-runlist.lock and returns...

UBUNTU-CVE-2026-72208

In the Linux kernel, the following vulnerability has been resolved: ntfs: add bounds check before accessing EA entries in ntfsealookup and ntfslistxattr, this verifies that there is enough space in the EA entry before accessing the nextentryoffset field of the EA entry...

UBUNTU-CVE-2026-72197

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: bound DeleteIndexEntryAllocation memmove length In doaction's DeleteIndexEntryAllocation case, e-size comes from an on-disk INDEXBUFFER entry. When e-size makes e + e-size point past hdr + hdr-used, PtrOffsete1,...

UBUNTU-CVE-2026-72205

In the Linux kernel, the following vulnerability has been resolved: ntfs: free volume-wide resources on fillsuper failure ntfsfillsuper's erroutnow path frees only the volume struct via kfreevol, leaving several vol-owned allocations behind on every mount failure: - vol-nlsmap, loaded by...

UBUNTU-CVE-2026-72206

In the Linux kernel, the following vulnerability has been resolved: ntfs: validate index block header more strictly Modify ntfsindexblockinconsisent to perform stricter validation of INDEXHEADER geometry in INDX blocks, and update ntfslookupinodebyname to use that function to validate INDX blocks...

UBUNTU-CVE-2026-72209

In the Linux kernel, the following vulnerability has been resolved: ntfs: validate attribute values on lookup ntfsattrfind and ntfsexternalattrfind check that generic resident attribute values fit in their attribute records and that fixed-size resident values are large enough. For variable-length...

UBUNTU-CVE-2026-72210

In the Linux kernel, the following vulnerability has been resolved: ntfs: fix off-by-one in mapping pairs decoding bounds checks In ntfsmappingpairsdecompress, attrend points one byte past the end of the attribute record: attrend = u8 attr + le32tocpuattr-length; The two bounds checks validating...

UBUNTU-CVE-2026-72194

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: add depth limit to indxfindbuffer to prevent stack overflow indxfindbuffer recursively descends the B+ tree index with no depth limit. A crafted NTFS image with circular index node references causes unbounded recursion,...

UBUNTU-CVE-2026-72198

In the Linux kernel, the following vulnerability has been resolved: ntfs: reject non-resident records for resident-only attributes The shared lookup-time attribute validator rejects non-resident $FILENAME and $VOLUMENAME records because their formats require resident values and callers handle...

UBUNTU-CVE-2026-72200

In the Linux kernel, the following vulnerability has been resolved: ntfs: detect mapping-pairs LCN accumulator overflow The NTFS mapping-pairs parser accumulates relative LCN deltas in a signed integer. A corrupted attribute can drive that addition past the representable range. One corrupt runlis...

UBUNTU-CVE-2026-72192

In the Linux kernel, the following vulnerability has been resolved: ntfs3: bound tomove in indxinsertintoroot before hdrinserthead indxinsertintoroot promotes a full resident $INDEXROOT into $INDEXALLOCATION and copies all non-last resident root entries into a newly allocated INDEXBUFFER via...

CVE-2026-72470 fs/ntfs3: resize log->one_page_buf when adopting on-disk page size

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: resize log-onepagebuf when adopting on-disk page size logreplay allocates log-onepagebuf using the page size that was chosen from the host PAGESIZE: log-onepagebuf = kmalloclog-pagesize, GFPNOFS; Later, when a restart...

EUVD-2026-59253

In the Linux kernel, the following vulnerability has been resolved: ntfs: avoid stale runlist element dereference in MFT writeback ntfswritemftblock maps each $MFT record through the $MFT data runlist. For sub-folio clusters it looks up a struct runlistelement under ni-runlist.lock, drops the loc...

CVE-2026-72354

Summary: CVE-2026-72354 affects the Linux kernel NTFS MFT writeback code, where a runlist_element borrowed under ni->runlist.lock can be freed by ntfs_rl_realloc during a concurrent $MFT extension. If the old runlist backing storage is freed after the lookup but before folio sizing, a use-afte...

CVE-2026-72354 ntfs: avoid stale runlist element dereference in MFT writeback

In the Linux kernel, the following vulnerability has been resolved: ntfs: avoid stale runlist element dereference in MFT writeback ntfswritemftblock maps each $MFT record through the $MFT data runlist. For sub-folio clusters it looks up a struct runlistelement under ni-runlist.lock, drops the loc...