CVE-2026-72195

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

fs/ntfs3: bound attr_off in UpdateResidentValue against data_off

In do_action()'s UpdateResidentValue case (fslog.c:3307),

lrh->attr_off and lrh->redo_len come from the on-disk LRH.

When they satisfy aoff + dlen < attr->res.data_off, the

assignment

attr->res.data_size = cpu_to_le32(aoff + dlen - data_off);

underflows to ~4 GiB (e.g. 0xFFFFFFF9 when aoff=0x10, dlen=1,

data_off=0x18). Subsequent code that reads attr->res.data_size

to walk the resident attribute payload would then read up to

4 GiB past the 1024-byte MFT record allocation.

The existing mi_enum_attr() defense in fs/ntfs3/record.c:287

catches the corrupted data_size on the next attribute walk

and fails the mount, but only on the path that walks all

attributes. A read site that picks an attribute by name and

reads its data_size without re-validating is not covered.

Validate aoff against data_off and asize at the source.

Reproduced under UML+KASAN on

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References