248638 matches found
CVE-2026-72195
In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: bound attroff in UpdateResidentValue against dataoff In doaction's UpdateResidentValue case fslog.c:3307, lrh-attroff and lrh-redolen come from the on-disk LRH. When they satisfy aoff + dlen res.dataoff, the assignment...
CVE-2026-72194 fs/ntfs3: add depth limit to indx_find_buffer to prevent stack overflow
In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: add depth limit to indxfindbuffer to prevent stack overflow indxfindbuffer recursively descends the B+ tree index with no depth limit. A crafted NTFS image with circular index node references causes unbounded recursion,...
EUVD-2026-58953
In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: bound attroff in UpdateResidentValue against dataoff In doaction's UpdateResidentValue case fslog.c:3307, lrh-attroff and lrh-redolen come from the on-disk LRH. When they satisfy aoff + dlen res.dataoff, the assignment...
CVE-2026-72194 fs/ntfs3: add depth limit to indx_find_buffer to prevent stack overflow
In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: add depth limit to indxfindbuffer to prevent stack overflow indxfindbuffer recursively descends the B+ tree index with no depth limit. A crafted NTFS image with circular index node references causes unbounded recursion,...
CVE-2026-72194
In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: add depth limit to indxfindbuffer to prevent stack overflow indxfindbuffer recursively descends the B+ tree index with no depth limit. A crafted NTFS image with circular index node references causes unbounded recursion,...
CVE-2026-72192
The CVE-2026-72192 issue affects the Linux kernel ntfs3 code. Specifically, indx_insert_into_root before hdr_insert_head can overrun a kmalloc(index_block_size) when shrinking root->index_block_size (e.g., to 512) after the root is populated. A crafted NTFS image triggers a memcpy of attacker-...
EUVD-2026-58950
In the Linux kernel, the following vulnerability has been resolved: ntfs3: bound tomove in indxinsertintoroot before hdrinserthead indxinsertintoroot promotes a full resident $INDEXROOT into $INDEXALLOCATION and copies all non-last resident root entries into a newly allocated INDEXBUFFER via...
CVE-2026-72192
In the Linux kernel, the following vulnerability has been resolved: ntfs3: bound tomove in indxinsertintoroot before hdrinserthead indxinsertintoroot promotes a full resident $INDEXROOT into $INDEXALLOCATION and copies all non-last resident root entries into a newly allocated INDEXBUFFER via...
CVE-2026-72192 ntfs3: bound to_move in indx_insert_into_root before hdr_insert_head
In the Linux kernel, the following vulnerability has been resolved: ntfs3: bound tomove in indxinsertintoroot before hdrinserthead indxinsertintoroot promotes a full resident $INDEXROOT into $INDEXALLOCATION and copies all non-last resident root entries into a newly allocated INDEXBUFFER via...
CVE-2026-72190
In the Linux kernel, the following vulnerability has been resolved: ntfs: fix mreclock ABBA deadlock in rename ntfsfilefsync, ntfsdirfsync and ntfswriteinode lock an inode's mreclock before taking the mreclock of its parent directory. ntfsrename takes oldni-mreclock and olddirni-mreclock before...
CVE-2026-72191
In the Linux kernel, the following vulnerability has been resolved: ntfs3: validate split-point offset in indxinsertintobuffer indxinsertintobuffer computes used = used1 - tocopy - spsize; memmovedet, Add2Ptrsp, spsize, used - le32tocpuhdr1-deoff; where sp and spsize come from hdrfindsplit...
CVE-2026-72190 ntfs: fix mrec_lock ABBA deadlock in rename
In the Linux kernel, the following vulnerability has been resolved: ntfs: fix mreclock ABBA deadlock in rename ntfsfilefsync, ntfsdirfsync and ntfswriteinode lock an inode's mreclock before taking the mreclock of its parent directory. ntfsrename takes oldni-mreclock and olddirni-mreclock before...
CVE-2026-72190
CVE-2026-72190 : The Linux kernel NTFS handling has a deadlock in rename due to mismatched lock ordering on mrec_lock between inodes and their parent directories. The functions ntfs_file_fsync(), ntfs_dir_fsync(), and __ntfs_write_inode() acquire an inode’s mrec_lock before its parent directory’s...
EUVD-2026-58948
In the Linux kernel, the following vulnerability has been resolved: ntfs: fix mreclock ABBA deadlock in rename ntfsfilefsync, ntfsdirfsync and ntfswriteinode lock an inode's mreclock before taking the mreclock of its parent directory. ntfsrename takes oldni-mreclock and olddirni-mreclock before...
CVE-2026-72191
CVE-2026-72191 (Linux kernel ntfs3): The issue arises in indx_insert_into_buffer where sp and sp_size from hdr_find_split() can cause an underflow when sp_size exceeds remaining buffer, producing an out-of-bounds write and kernel panic. Reports show a crafted NTFS image where interior NTFS_DE siz...
CVE-2026-72190 ntfs: fix mrec_lock ABBA deadlock in rename
In the Linux kernel, the following vulnerability has been resolved: ntfs: fix mreclock ABBA deadlock in rename ntfsfilefsync, ntfsdirfsync and ntfswriteinode lock an inode's mreclock before taking the mreclock of its parent directory. ntfsrename takes oldni-mreclock and olddirni-mreclock before...
CVE-2026-72191 ntfs3: validate split-point offset in indx_insert_into_buffer
In the Linux kernel, the following vulnerability has been resolved: ntfs3: validate split-point offset in indxinsertintobuffer indxinsertintobuffer computes used = used1 - tocopy - spsize; memmovedet, Add2Ptrsp, spsize, used - le32tocpuhdr1-deoff; where sp and spsize come from hdrfindsplit...
CVE-2026-72189
CVE-2026-72189 concerns the Linux kernel ntfs attribute-list update path. When the superblock becomes inactive, generic_shutdown_super() clears SB_ACTIVE and eviction of inodes can cause the fake inode for a base inode’s unnamed $ATTRIBUTE_LIST to be referenced in a way that leads to a self-deadl...
CVE-2026-72189 ntfs: fail attrlist updates when the superblock is inactive
In the Linux kernel, the following vulnerability has been resolved: ntfs: fail attrlist updates when the superblock is inactive genericshutdownsuper clears SBACTIVE before evicting cached inodes. If eviction selects the fake inode for a base inode's unnamed $ATTRIBUTELIST attribute,...
CVE-2026-72189
In the Linux kernel, the following vulnerability has been resolved: ntfs: fail attrlist updates when the superblock is inactive genericshutdownsuper clears SBACTIVE before evicting cached inodes. If eviction selects the fake inode for a base inode's unnamed $ATTRIBUTELIST attribute,...