CVE-2026-45935 fs/ntfs3: Fix slab-out-of-bounds read in DeleteIndexEntryRoot
A slab-out-of-bounds read in the Linux kernel NTFS3 driver allows attackers to trigger heap buffer overflows via maliciously crafted NTFS images, potentially leading to code execution or system crashes.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-45935?
CVE-2026-45935 is a high-severity memory corruption vulnerability in Linux kernel, published on 27 May 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
In the Linux kernel, the following vulnerability has been resolved:
fs/ntfs3: Fix slab-out-of-bounds read in DeleteIndexEntryRoot
In the 'DeleteIndexEntryRoot' case of the 'do_action' function, the entry size ('esize') is retrieved from the log record without adequate bounds checking.
Specifically, the code calculates the end of the entry ('e2') using: e2 = Add2Ptr(e1, esize);
It then calculates the size for memmove using 'PtrOffset(e2, ...)', which subtracts the end pointer from the buffer limit. If 'esize' is maliciously large, 'e2' exceeds the used buffer size. This results in a negative offset which, when cast to size_t for memmove, interprets as a massive unsigned integer, leading to a heap buffer overflow.
This commit adds a check to ensure that the entry size ('esize') strictly fits within the remaining used space of the index header before performing memory operations.
Weakness: CWE-125
Which versions are affected by CVE-2026-45935?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-45935?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-45935 being exploited?
There is no known exploitation of CVE-2026-45935 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2026-45935, DEBIAN-CVE-2026-45935, GHSA-4cvx-h6xx-mj53, ROOT-OS-UBUNTU-2204-CVE-2026-45935, ROOT-OS-UBUNTU-2404-CVE-2026-45935, UBUNTU-CVE-2026-45935.