CVE-2026-72195 fs/ntfs3: bound attr_off in UpdateResidentValue against data_off
An integer underflow in the Linux kernel NTFS3 driver allows out-of-bounds reads, potentially causing system crashes or leaking memory contents.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-72195?
CVE-2026-72195 is a high-severity vulnerability in Linux, published on 15 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
fs/ntfs3: bound attr_off in UpdateResidentValue against data_off
In do_action()'s UpdateResidentValue case (fslog.c:3307), lrh->attr_off and lrh->redo_len come from the on-disk LRH. When they satisfy aoff + dlen < attr->res.data_off, the assignment
attr->res.data_size = cpu_to_le32(aoff + dlen - data_off);
underflows to ~4 GiB (e.g. 0xFFFFFFF9 when aoff=0x10, dlen=1, data_off=0x18). Subsequent code that reads attr->res.data_size to walk the resident attribute payload would then read up to 4 GiB past the 1024-byte MFT record allocation.
The existing mi_enum_attr() defense in fs/ntfs3/record.c:287 catches the corrupted data_size on the next attribute walk and fails the mount, but only on the path that walks all attributes. A read site that picks an attribute by name and reads its data_size without re-validating is not covered. Validate aoff against data_off and asize at the source.
Reproduced under UML+KASAN on mainline 8d90b09e6741 via pr_warn-only probe: with aoff=0x10 and data_off=0x18, the post-assignment data_size is 0xfffffff9 (mount then fails at -22 from mi_enum_attr).
[[email protected]: clang-formatted the changes]
Which versions are affected by CVE-2026-72195?
How do I fix CVE-2026-72195?
Apply the vendor's patch.
Is CVE-2026-72195 being exploited?
There is no known exploitation of CVE-2026-72195 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2026-72195, DEBIAN-CVE-2026-72195, GHSA-44j2-h353-38w7, UBUNTU-CVE-2026-72195.