CVE-2026-72197

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

fs/ntfs3: bound DeleteIndexEntryAllocation memmove length

In do_action()'s DeleteIndexEntryAllocation case, e->size comes

from an on-disk INDEX_BUFFER entry. When e->size makes

e + e->size point past hdr + hdr->used,

PtrOffset(e1, Add2Ptr(hdr, used)) returns a negative ptrdiff_t

that is silently cast to a quasi-infinite size_t when passed

to memmove(). The memmove then walks past the destination

buffer.

The sibling DeleteIndexEntryRoot case at fslog.c:3540-3543

already carries the corresponding guard:

if (PtrOffset(e1, Add2Ptr(hdr, used)) < esize ||

Add2Ptr(e, esize) > Add2Ptr(lrh, rec_len) ||

used + esize > le32_to_cpu(hdr->total)) {

goto dirty_vol;

}

Apply the same shape to the allocation-path case. Also reject

esize == 0: memmove(e, e, ...) is a no-op and leaves

hdr->used unchanged, hiding a malformed entry from the

existing check_index_header() walk.

Reproduced under UML+KASAN on mainline 8d9

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References