CVE-2026-72199

The CVE refers to the Linux kernel ntfs patch that validates resident index root values on lookup. The fix ensures 8-byte alignment of index header fields, sane entries_offset, index_length within allocated_size, and allocated_size consistency within the resident value, and it validates header in...

CVE-2026-72197 fs/ntfs3: bound DeleteIndexEntryAllocation memmove length

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: bound DeleteIndexEntryAllocation memmove length In doaction's DeleteIndexEntryAllocation case, e-size comes from an on-disk INDEXBUFFER entry. When e-size makes e + e-size point past hdr + hdr-used, PtrOffsete1,...

CVE-2026-72198 ntfs: reject non-resident records for resident-only attributes

In the Linux kernel, the following vulnerability has been resolved: ntfs: reject non-resident records for resident-only attributes The shared lookup-time attribute validator rejects non-resident $FILENAME and $VOLUMENAME records because their formats require resident values and callers handle...

CVE-2026-72198 ntfs: reject non-resident records for resident-only attributes

In the Linux kernel, the following vulnerability has been resolved: ntfs: reject non-resident records for resident-only attributes The shared lookup-time attribute validator rejects non-resident $FILENAME and $VOLUMENAME records because their formats require resident values and callers handle...

CVE-2026-72198

CVE-2026-72198 relates to the Linux kernel NTFS handling of resident/non-resident attribute data. The fix rejects non-resident records for all resident-only attribute types in the shared validator, extending the prior FILE_NAME and VOLUME_NAME handling to include STANDARD_INFORMATION, OBJECT_ID, ...

CVE-2026-72197

The CVE-2026-72197 issue affects the Linux kernel, specifically the fs/ntfs3 path for DeleteIndexEntryAllocation. The root cause is that e->size can cause an overlong memmove when e + e->size points past hdr + hdr->used, leading to a dangerous memmove length. A corresponding guard alread...

EUVD-2026-58955

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: bound DeleteIndexEntryAllocation memmove length In doaction's DeleteIndexEntryAllocation case, e-size comes from an on-disk INDEXBUFFER entry. When e-size makes e + e-size point past hdr + hdr-used, PtrOffsete1,...

EUVD-2026-58956

In the Linux kernel, the following vulnerability has been resolved: ntfs: reject non-resident records for resident-only attributes The shared lookup-time attribute validator rejects non-resident $FILENAME and $VOLUMENAME records because their formats require resident values and callers handle...

CVE-2026-72194 fs/ntfs3: add depth limit to indx_find_buffer to prevent stack overflow

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: add depth limit to indxfindbuffer to prevent stack overflow indxfindbuffer recursively descends the B+ tree index with no depth limit. A crafted NTFS image with circular index node references causes unbounded recursion,...

CVE-2026-72194 fs/ntfs3: add depth limit to indx_find_buffer to prevent stack overflow

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: add depth limit to indxfindbuffer to prevent stack overflow indxfindbuffer recursively descends the B+ tree index with no depth limit. A crafted NTFS image with circular index node references causes unbounded recursion,...

EUVD-2026-58952

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: add depth limit to indxfindbuffer to prevent stack overflow indxfindbuffer recursively descends the B+ tree index with no depth limit. A crafted NTFS image with circular index node references causes unbounded recursion,...

CVE-2026-72192

The CVE-2026-72192 issue affects the Linux kernel ntfs3 code. Specifically, indx_insert_into_root before hdr_insert_head can overrun a kmalloc(index_block_size) when shrinking root->index_block_size (e.g., to 512) after the root is populated. A crafted NTFS image triggers a memcpy of attacker-...

CVE-2026-72192 ntfs3: bound to_move in indx_insert_into_root before hdr_insert_head

In the Linux kernel, the following vulnerability has been resolved: ntfs3: bound tomove in indxinsertintoroot before hdrinserthead indxinsertintoroot promotes a full resident $INDEXROOT into $INDEXALLOCATION and copies all non-last resident root entries into a newly allocated INDEXBUFFER via...

EUVD-2026-58950

In the Linux kernel, the following vulnerability has been resolved: ntfs3: bound tomove in indxinsertintoroot before hdrinserthead indxinsertintoroot promotes a full resident $INDEXROOT into $INDEXALLOCATION and copies all non-last resident root entries into a newly allocated INDEXBUFFER via...

CVE-2026-72192 ntfs3: bound to_move in indx_insert_into_root before hdr_insert_head

In the Linux kernel, the following vulnerability has been resolved: ntfs3: bound tomove in indxinsertintoroot before hdrinserthead indxinsertintoroot promotes a full resident $INDEXROOT into $INDEXALLOCATION and copies all non-last resident root entries into a newly allocated INDEXBUFFER via...

EUVD-2026-58948

In the Linux kernel, the following vulnerability has been resolved: ntfs: fix mreclock ABBA deadlock in rename ntfsfilefsync, ntfsdirfsync and ntfswriteinode lock an inode's mreclock before taking the mreclock of its parent directory. ntfsrename takes oldni-mreclock and olddirni-mreclock before...

CVE-2026-72190

CVE-2026-72190 : The Linux kernel NTFS handling has a deadlock in rename due to mismatched lock ordering on mrec_lock between inodes and their parent directories. The functions ntfs_file_fsync(), ntfs_dir_fsync(), and __ntfs_write_inode() acquire an inode’s mrec_lock before its parent directory’s...

CVE-2026-72190 ntfs: fix mrec_lock ABBA deadlock in rename

In the Linux kernel, the following vulnerability has been resolved: ntfs: fix mreclock ABBA deadlock in rename ntfsfilefsync, ntfsdirfsync and ntfswriteinode lock an inode's mreclock before taking the mreclock of its parent directory. ntfsrename takes oldni-mreclock and olddirni-mreclock before...

CVE-2026-72191 ntfs3: validate split-point offset in indx_insert_into_buffer

In the Linux kernel, the following vulnerability has been resolved: ntfs3: validate split-point offset in indxinsertintobuffer indxinsertintobuffer computes used = used1 - tocopy - spsize; memmovedet, Add2Ptrsp, spsize, used - le32tocpuhdr1-deoff; where sp and spsize come from hdrfindsplit...

CVE-2026-72190 ntfs: fix mrec_lock ABBA deadlock in rename

In the Linux kernel, the following vulnerability has been resolved: ntfs: fix mreclock ABBA deadlock in rename ntfsfilefsync, ntfsdirfsync and ntfswriteinode lock an inode's mreclock before taking the mreclock of its parent directory. ntfsrename takes oldni-mreclock and olddirni-mreclock before...