CVE-2026-90200 fs/ntfs3: fix integer overflow in MFT cluster validation

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: fix integer overflow in MFT cluster validation In ntfsinitfromboot, the boot sector's MFT cluster numbers are validated against the volume size with: if mlcn sctperclst = sectors || mlcn2 sctperclst = sectors goto out;...

CVE-2026-90199 fs/ntfs3: reject out-of-range evcn in mi_enum_attr()

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: reject out-of-range evcn in mienumattr In mienumattr, the start/end VCN validation for non-resident attributes is: if svcn evcn + 1 goto out; When evcn is U64MAX the "evcn + 1" expression wraps to 0 and any svcn passes...

AZL-101345 CVE-2026-89785 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: fix out-of-bounds read of INDEXROOT in reparse/objid init ntfsreparseinit and ntfsobjidinit parse the index root of the $Extend/$Reparse and $Extend/$ObjId metafiles the INDEXROOT attributes named $R and $O. They read i...

CVE-2026-89781

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: fix out-of-bounds read in readlogrecbuf readlogrecbuf copies a log record into a caller buffer starting at u32 off = lsntopageofflog, lsn + log-recordheaderlen; log-recordheaderlen and log-dataoff, used for the followin...

AZL-101265 CVE-2026-89779 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: validate ef-size covers the record's name and value When an EA record has a non-zero ef-size, ntfsreadea only checks that the record fits in the remaining buffer easize bytes, not that ef-size is large enough to hold th...

CVE-2026-89785

CVE-2026-89785 is an out-of-bounds read in the Linux kernel's NTFS3 filesystem driver. The functions ntfs_reparse_init() and ntfs_objid_init() parse the INDEX_ROOT attributes ($R and $O) of the $Extend/$Reparse and $Extend/$ObjId metafiles using resident_data() , which fails to verify that the re...

CVE-2026-89782 fs/ntfs3: reject restart table growth beyond U16_MAX entries

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: reject restart table growth beyond U16MAX entries During $LogFile replay, logreplay indexes the transaction table by the transactid taken from the log record header. checklogrec only verifies that transactid is non-zero...

CVE-2026-89781

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: fix out-of-bounds read in readlogrecbuf readlogrecbuf copies a log record into a caller buffer starting at u32 off = lsntopageofflog, lsn + log-recordheaderlen; log-recordheaderlen and log-dataoff, used for the followin...

CVE-2026-89781 fs/ntfs3: fix out-of-bounds read in read_log_rec_buf()

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: fix out-of-bounds read in readlogrecbuf readlogrecbuf copies a log record into a caller buffer starting at u32 off = lsntopageofflog, lsn + log-recordheaderlen; log-recordheaderlen and log-dataoff, used for the followin...

CVE-2026-89781

CVE-2026-89781 is an out-of-bounds read in the Linux kernel fs/ntfs3 driver, specifically in read_log_rec_buf() (fs/ntfs3/fslog.c). The function copies a log record using an offset derived from log->record_header_len, which is read verbatim from the on-disk restart area and only validated for ...

CVE-2026-89779 fs/ntfs3: validate ef->size covers the record's name and value

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: validate ef-size covers the record's name and value When an EA record has a non-zero ef-size, ntfsreadea only checks that the record fits in the remaining buffer easize bytes, not that ef-size is large enough to hold th...

The vulnerability of the fs/ntfs3 component in the Linux operating system allows a hacker to gain access to confidential data.

The vulnerability of the fs/ntfs3 component in the Linux operating system is related to access to an uninitialized pointer. Exploiting this vulnerability could allow an attacker to gain access to confidential data...

PT-2025-25983 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 5.18.0-rc3-syzkaller-00016-gb253435746d9 Description: A NULL pointer dereference issue has been identified in the Linux kernel, specifically in the fs/ntfs3 component. This issue occurs when the ntfs fill super...

CVE-2021-47660

CVE-2021-47660 is addressed by a Linux kernel fix in the ntfs3 filesystem code. The patch resolves memory leaks in an error-handling path of log_replay(), ensuring that on all error paths the allocated resources are released via the existing out path instead of leaking through returns. The descri...

PT-2025-20335

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to the fixed version Description A NULL pointer dereference issue has been identified in the Linux kernel, specifically in the fs/ntfs3 module. This issue occurs when a user executes an ioctl command to clear the...

CVE-2024-50245

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Fix possible deadlock in miread Mutex lock with another subclass used in nilockdir...

CVE-2024-50244

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Additional check in niclear Checking of NTFSFLAGSLOGREPLAYING added to prevent access to uninitialized bitmap during replay process...

CVE-2024-50242

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Additional check in ntfsfilerelease...

CVE-2024-50247 fs/ntfs3: Check if more than chunk-size bytes are written

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Check if more than chunk-size bytes are written A incorrectly formatted chunk may decompress into more than LZNTCHUNKSIZE bytes and a index out of bounds will occur in smaxoff...

CVE-2024-50247

CVE-2024-50247 affects the Linux kernel ntfs3 path where an incorrectly formatted chunk may decompress to more than LZNT_CHUNK_SIZE bytes, causing an index out of bounds in s_max_off. The Connected documents confirm this CVE is included in multiple advisories (e.g., ALAS2023LIVEPATCH advisories) ...