CVE-2026-72192

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

ntfs3: bound to_move in indx_insert_into_root before hdr_insert_head

indx_insert_into_root() promotes a full resident $INDEX_ROOT into

$INDEX_ALLOCATION and copies all non-last resident root entries into

a newly allocated INDEX_BUFFER via hdr_insert_head(). The source

byte count 'to_move' is summed from the on-disk resident entry sizes

and is independent of the destination buffer size, which comes from

root->index_block_size (via indx->index_bits).

A crafted NTFS image that keeps a valid, full resident root but

shrinks root->index_block_size down to 512 after the root has been

populated makes hdr_insert_head() memcpy attacker-controlled resident

entry bytes past the end of the kmalloc(1u << indx->index_bits)

allocation returned by indx_new(). For a 512-byte destination and a

resident root whose non-last entries total 560 bytes, the memcpy

overruns by 120 bytes and a following memmove extends the highest

written offs

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References