CVE-2026-72470

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

fs/ntfs3: resize log->one_page_buf when adopting on-disk page size

log_replay() allocates log->one_page_buf using the page size that was

chosen from the host PAGE_SIZE:

log->one_page_buf = kmalloc(log->page_size, GFP_NOFS);

Later, when a restart area is found, the log page size recorded on disk

is adopted:

t32 = le32_to_cpu(log->rst_info.r_page->sys_page_size);

if (log->page_size != t32) {

log->l_size = log->orig_file_size;

log->page_size = norm_file_page(t32, &log->l_size,

t32 == DefaultLogPageSize);

}

If the on-disk page size is larger than the size used for the initial

allocation, log->page_size grows but one_page_buf is left at its

original, smaller size. A subsequent unaligned read_log_page() then

reads log->page_size bytes into the undersized scratch buffer:

page_buf = page_off ? log->one_page_buf : *buffer;

err = ntfs_read_run_nb_ra(ni->mi.sbi, &ni->file.run, page_vbo, page_buf,

log-

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References