Astra Linux – vulnerability in linux-6.1, linux-5.15

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Check if more than chunk-size bytes are written An incorrectly formatted chunk may decompress into more than LZNTCHUNKSIZE bytes, resulting in an out-of-bounds index in smaxoff...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: ntfs3: Treating $Extend records as regular files. Since the commit af153bb63a33 "vfs: catching invalid modes in mayopen" requires that any inode be of one of the types SIFDIR/SIFLNK/SIFREG/SIFCHR/SIFBLK/SIFIFO/SIFSOCK, use SIFREG...

Astra Linux – vulnerability in linux-6.1, linux-5.15

In the Linux kernel, the following vulnerability has been resolved: ntfs3: Fix uninit buffer allocated by getname The uninit errors that occur after allocating a buffer to ‘de’ are now fixed by initializing the buffer with zeros. This fix was discovered using KMSAN...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: validate BOOT sectorsperclusters When the NTFS BOOT sectorsperclusters field is greater than 0x80, it represents a shift value. Ensure that the shift value is not too large before using it the maximum cluster size for...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Add null pointer check for inode operations This adds a sanity check for the iop pointer of the inode which is returned after reading Root directory MFT record. We should check the iop is valid before trying to create t...

Linux Distros Unpatched Vulnerability : CVE-2026-64432

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: validate Dirty Page Table capacity in logreplay copylcns In the analysis pass of...

Linux Distros Unpatched Vulnerability : CVE-2026-63833

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ntfs3: reject direct userspace writes to reserved $LX xattrs NTFS3 uses $LXUID, $LXGID, $LXMOD and $LXDEV as internal WSL permission metadata and reloads them...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: fixed a deadlock in nireadfoliocmpr. Syzbot reported a task that got hung in nireadpagecmpr now nireadfoliocmpr. This issue is caused by a lock inversion deadlock involving the inode mutex nilock and page locks. Scenari...

EUVD-2026-32454

In the Linux kernel, the following vulnerability has been resolved: ntfs3: add buffer boundary checks to rununpack rununpack checks runbuf runlast at the top of the while loop but then reads sizesize and offsetsize bytes via rununpacks64 without verifying they fit within the remaining buffer. A...

Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.15-2026-100 (ALASKERNEL-5.15-2026-100)

The version of kernel installed on the remote host is prior to 5.15.202-141.223. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.15-2026-100 advisory. In the Linux kernel, the following vulnerability has been resolved: fs: ntfs3: fix infinite loop in...

ntfs3 DoS

The vulnerability in the ntfs3 component of the Linux kernel is related to the execution of a loop with an unreachable exit condition. Exploitation of this vulnerability may allow an attacker to cause a denial of service...

Linux Distros Unpatched Vulnerability : CVE-2025-71266

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - fs: ntfs3: check return value of indxfind to avoid infinite loop We found an infinite loop bug in the ntfs3 file system that can lead to a Denial-of-Service DoS...

Linux Distros Unpatched Vulnerability : CVE-2025-71265

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - fs: ntfs3: fix infinite loop in attrloadrunsrange on inconsistent metadata We found an infinite loop bug in the ntfs3 file system that can lead to a...

Linux Distros Unpatched Vulnerability : CVE-2022-50869

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - fs/ntfs3: Fix slab-out-of-bounds in rpage When PAGESIZE is 64K, if readlogpage is called by logreadrst for the first time, the size of buffer would be equal to...

AZL-78410 CVE-2025-68365 affecting package kernel for versions less than 5.15.200.1-1

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Initialize allocated memory before use KMSAN reports: Multiple uninitialized values detected: - KMSAN: uninit-value in ntfsreadhdr 3 - KMSAN: uninit-value in bcmp 3 Memory is allocated by getname, which is a wrapper for...

CVE-2023-53988 fs/ntfs3: Fix slab-out-of-bounds read in hdr_delete_de()

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Fix slab-out-of-bounds read in hdrdeletede Here is a BUG report from syzbot: BUG: KASAN: slab-out-of-bounds in hdrdeletede+0xe0/0x150 fs/ntfs3/index.c:806 Read of size 16842960 at addr ffff888079cc0600 by task...

Linux Distros Unpatched Vulnerability : CVE-2025-68727

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ntfs3: Fix uninit buffer allocated by getname Fix uninit errors caused after buffer allocation given to 'de'; by initializing the buffer with zeroes. The fix wa...

CVE-2025-40313

CVE-2025-40313 is a Linux kernel vulnerability in ntfs3 where the system treated certain $Extend records as non-files due to a type check in may_open(). The fix changes the inode type used for $Extend records to S_IFREG (regular file) to satisfy the allowed inode types (S_IFDIR/S_IFLNK/S_IFREG/S_...

Linux Distros Unpatched Vulnerability : CVE-2025-40313

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ntfs3: pretend $Extend records as regular files Since commit af153bb63a33 vfs: catch invalid modes in mayopen requires any inode be one of...

Linux kernel fs/ntfs3 DoS

Vulnerability of the fs/ntfs3 component: Linux operating systems are vulnerable to integer overflows. Exploitation of this vulnerability could allow an attacker to cause a system failure...