CVE-2026-72191

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

ntfs3: validate split-point offset in indx_insert_into_buffer

indx_insert_into_buffer() computes

used = used1 - to_copy - sp_size;

memmove(de_t, Add2Ptr(sp, sp_size), used - le32_to_cpu(hdr1->de_off));

where sp and sp_size come from hdr_find_split(). hdr_find_split()

walks entries by le16_to_cpu(e->size) without validating that each

step stays within hdr->used or that the size field is at least

sizeof(struct NTFS_DE). index_hdr_check(), the on-load gatekeeper,

only validates header-level fields (used, total, de_off) and does

not walk per-entry sizes.

A crafted NTFS image whose leaf INDEX_HDR reports used == total but

contains one interior NTFS_DE with size = 0xFFF0 therefore passes

validation, descends to indx_insert_into_buffer() through the

ntfs_create() -> indx_insert_entry() path, and makes hdr_find_split()

return an sp whose sp_size (0xFFF0) greatly exceeds the remaining

bytes in the buffer. The u3

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References