CVE-2026-72209

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ntfs: validate attribute values on lookup

ntfs_attr_find() and ntfs_external_attr_find() check that generic

resident attribute values fit in their attribute records and that

fixed-size resident values are large enough. For variable-length resident

formats, however, the fixed part is not enough: embedded length fields

can still point callers past the resident value.

A crafted image can set a small resident $FILE_NAME value_length while

leaving file_name_length large. Callers then trust file_name_length and

read past the resident value when converting or comparing the name. This

was reproduced with a crafted image under KASAN as a slab-out-of-bounds

read from the kmalloc-1k MFT record copy. The stack included

ntfs_lookup(), ntfs_iget(), ntfs_read_locked_inode(), ntfs_attr_name_get(),

ntfs_ucstonls(), and utf16s_to_utf8s().

Add a shared attribute value validator and use it before a lookup path

can return an attribute,

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References