CVE-2026-97438

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

fs/ntfs3: validate index entry key bounds

[BUG]

A malformed NTFS directory index entry can advertise a key_size larger

than the bytes actually present in its NTFS_DE payload. Directory lookup

then passes that malformed key to cmp_fnames(), which can read past the

end of the kmalloc'ed index buffer.

BUG: KASAN: slab-out-of-bounds in fname_full_size fs/ntfs3/ntfs.h:590 [inline]

BUG: KASAN: slab-out-of-bounds in cmp_fnames+0x1ea/0x230 fs/ntfs3/index.c:46

Read of size 1 at addr ffff88801c313018 by task syz.6.3365/9279

Call Trace:

__dump_stack lib/dump_stack.c:94 [inline]

dump_stack_lvl+0xbe/0x130 lib/dump_stack.c:120

print_address_description mm/kasan/report.c:378 [inline]

print_report+0xd1/0x650 mm/kasan/report.c:482

kasan_report+0xfb/0x140 mm/kasan/report.c:595

__asan_report_load1_noabort+0x14/0x30 mm/kasan/report_generic.c:378

fname_full_size fs/ntfs3/ntfs.h:590 [inline]

cmp_fnames+0x1ea/0x230 fs/ntfs3/index

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References