CVE-2026-31716

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

fs/ntfs3: validate rec->used in journal-replay file record check

check_file_record() validates rec->total against the record size but

never validates rec->used. The do_action() journal-replay handlers read

rec->used from disk and use it to compute memmove lengths:

DeleteAttribute: memmove(attr, ..., used - asize - roff)

CreateAttribute: memmove(..., attr, used - roff)

change_attr_size: memmove(..., used - PtrOffset(rec, next))

When rec->used is smaller than the offset of a validated attribute, or

larger than the record size, these subtractions can underflow allowing

us to copy huge amounts of memory in to a 4kb buffer, generally

considered a bad idea overall.

This requires a corrupted filesystem, which isn't a threat model the

kernel really needs to worry about, but checking for such an obvious

out-of-bounds value is good to keep things robust, especially on journal

replay

Fix this up by bounding r

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References