CVE-2026-72210

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

ntfs: fix off-by-one in mapping pairs decoding bounds checks

In ntfs_mapping_pairs_decompress(), attr_end points one byte past the

end of the attribute record:

attr_end = (u8 *)attr + le32_to_cpu(attr->length);

The two bounds checks validating that mapping pair data bytes fit within

the attribute use strict greater-than (>), which allows a one-byte

out-of-bounds read when the data extends exactly to attr_end:

b = *buf & 0xf;

if (b) {

if (unlikely(buf + b > attr_end)) // off-by-one

goto io_error;

for (deltaxcn = (s8)buf[b--]; b; b--)

deltaxcn = (deltaxcn << 8) + buf[b];

}

When buf + b == attr_end, the check evaluates to false and buf[b] reads

one byte past the valid attribute boundary. The same pattern appears in

the LCN delta bytes check.

Fix both checks to use >= so that buf[b] at exactly attr_end is

correctly rejected as out of bounds.

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References