CVE-2026-72197 fs/ntfs3: bound DeleteIndexEntryAllocation memmove length
A missing bounds check in the Linux kernel NTFS3 driver allows a crafted image to cause a kernel oops via an integer overflow in memmove.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-72197?
CVE-2026-72197 is a high-severity vulnerability in Linux, published on 15 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
fs/ntfs3: bound DeleteIndexEntryAllocation memmove length
In do_action()'s DeleteIndexEntryAllocation case, e->size comes from an on-disk INDEX_BUFFER entry. When e->size makes e + e->size point past hdr + hdr->used, PtrOffset(e1, Add2Ptr(hdr, used)) returns a negative ptrdiff_t that is silently cast to a quasi-infinite size_t when passed to memmove(). The memmove then walks past the destination buffer.
The sibling DeleteIndexEntryRoot case at fslog.c:3540-3543 already carries the corresponding guard:
if (PtrOffset(e1, Add2Ptr(hdr, used)) < esize || Add2Ptr(e, esize) > Add2Ptr(lrh, rec_len) || used + esize > le32_to_cpu(hdr->total)) { goto dirty_vol; }
Apply the same shape to the allocation-path case. Also reject esize == 0: memmove(e, e, ...) is a no-op and leaves hdr->used unchanged, hiding a malformed entry from the existing check_index_header() walk.
Reproduced under UML+KASAN on mainline 8d90b09e6741 by mounting a crafted NTFS image: the unguarded memmove takes a length of 0xffffffffffffff00 and the kernel oopses in memmove+0x81/0x1a0 on the do_action+0x36a2 frame.
[[email protected]: clang-formatted the changes]
Which versions are affected by CVE-2026-72197?
How do I fix CVE-2026-72197?
Apply the vendor's patch.
Is CVE-2026-72197 being exploited?
There is no known exploitation of CVE-2026-72197 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2026-72197, DEBIAN-CVE-2026-72197, GHSA-j9fv-qm2v-gr26, UBUNTU-CVE-2026-72197.