CVE-2026-72196 - Vulnerability Details

- fs/ntfs3: bound copy_lcns dp->page_lcns[] index in analysis pass

Description

In the Linux kernel, the following vulnerability has been resolved:

fs/ntfs3: bound copy_lcns dp->page_lcns[] index in analysis pass

In log_replay()'s analysis pass, after find_dp() returns a
valid DIR_PAGE_ENTRY for the (target_attr, target_vcn) tuple,
the copy_lcns block walks lrh->lcns_follow further entries:

t16 = le16_to_cpu(lrh->lcns_follow);
for (i = 0; i < t16; i++) {
size_t j = (size_t)(le64_to_cpu(lrh->target_vcn) -
le64_to_cpu(dp->vcn));
dp->page_lcns[j + i] = lrh->page_lcns[i];
}

find_dp() only validates that target_vcn falls within
[dp->vcn, dp->vcn + dp->lcns_follow), i.e., that the FIRST
cluster is covered. The walk through the further entries is
not bounded against dp->lcns_follow. For a malformed LRH
where target_vcn = dp->vcn + dp->lcns_follow - 1 and
lrh->lcns_follow > 1, the i > 0 writes overflow the dp's
allocated page_lcns[] array.

Add the missing j + lrh->lcns_follow <= dp->lcns_follow guard.

Reproduced under UML+KASAN on mainline 8d90b09e6741 as a
slab-out-of-bounds write of size 8 from log_replay+0x68d4 on
the mount path.

This is distinct from Pavitra Jha's 2026-05-02 patch
("fs/ntfs3: validate lcns_follow in log_replay conversion",
<20260502154252.164586-1-jhapavitra98@gmail.com>) which
addresses the separate version-0 dirty-page-table conversion
path's memmove(&dp->vcn, ...) call. The two fixes are
complementary; both should land.

[almaz.alexandrovich@paragon-software.com: clang-formatted the changes,
fixed conflicts]

Published: 2026-08-15

Score: n/a

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`b46acd6a6a627d876898e1c84d3f84902264b445`	affected	< 9b3d8cc9d54fcded4de51b2b1026ae7182512077
`b46acd6a6a627d876898e1c84d3f84902264b445`	affected	< 9b7c28d8c61bdb041936222a09a708531a1c2921
`b46acd6a6a627d876898e1c84d3f84902264b445`	affected	< 0f13e823bf86bd1800168ea0bb5bca8b8500a81c
`b46acd6a6a627d876898e1c84d3f84902264b445`	affected	< d240cd98f5f7b65c90f6b2b6abe3232ccdc405ab
`b46acd6a6a627d876898e1c84d3f84902264b445`	affected	< 49c86dae0c0ccb8d98ddcdc46987259389c816dd
`b46acd6a6a627d876898e1c84d3f84902264b445`	affected	< 5e7b598660cfa8e5af172cf4c65cffc126333307

Linux

affected

Version	Status	Constraints
`5.15`	affected	—
`0`	unaffected	< 5.15
`6.1.178`	unaffected	≤ 6.1.*
`6.6.145`	unaffected	≤ 6.6.*
`6.12.97`	unaffected	≤ 6.12.*
`6.18.40`	unaffected	≤ 6.18.*
`7.1.5`	unaffected	≤ 7.1.*
`7.2-rc1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[b46acd6a6a627d876898e1c84d3f84902264b445,9b3d8cc9d54fcded4de51b2b1026ae7182512077)`	affected	code_commit	—
`[b46acd6a6a627d876898e1c84d3f84902264b445,9b7c28d8c61bdb041936222a09a708531a1c2921)`	affected	code_commit	—
`[b46acd6a6a627d876898e1c84d3f84902264b445,0f13e823bf86bd1800168ea0bb5bca8b8500a81c)`	affected	code_commit	—
`[b46acd6a6a627d876898e1c84d3f84902264b445,d240cd98f5f7b65c90f6b2b6abe3232ccdc405ab)`	affected	code_commit	—
`[b46acd6a6a627d876898e1c84d3f84902264b445,49c86dae0c0ccb8d98ddcdc46987259389c816dd)`	affected	code_commit	—
`[b46acd6a6a627d876898e1c84d3f84902264b445,5e7b598660cfa8e5af172cf4c65cffc126333307)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`5.15`	affected	semver	—
`[0,5.15)`	unaffected	semver	—
`[6.1.178,6.2.0)`	unaffected	semver	—
`[6.6.145,6.7.0)`	unaffected	semver	—
`[6.12.97,6.13.0)`	unaffected	semver	—
`[6.18.40,6.19.0)`	unaffected	semver	—
`[7.1.5,7.2.0)`	unaffected	semver	—
`[7.2-rc1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00215.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/0f13e823bf86bd1800168ea0bb5bca8b8500a81c
https://git.kernel.org/stable/c/49c86dae0c0ccb8d98ddcdc46987259389c816dd
https://git.kernel.org/stable/c/5e7b598660cfa8e5af172cf4c65cffc126333307
https://git.kernel.org/stable/c/9b3d8cc9d54fcded4de51b2b1026ae7182512077
https://git.kernel.org/stable/c/9b7c28d8c61bdb041936222a09a708531a1c2921
https://git.kernel.org/stable/c/d240cd98f5f7b65c90f6b2b6abe3232ccdc405ab

History

Sat, 15 Aug 2026 20:00:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-122

Sat, 15 Aug 2026 06:00:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: bound copy_lcns dp->page_lcns[] index in analysis pass In log_replay()'s analysis pass, after find_dp() returns a valid DIR_PAGE_ENTRY for the (target_attr, target_vcn) tuple, the copy_lcns block walks lrh->lcns_follow further entries: t16 = le16_to_cpu(lrh->lcns_follow); for (i = 0; i < t16; i++) { size_t j = (size_t)(le64_to_cpu(lrh->target_vcn) - le64_to_cpu(dp->vcn)); dp->page_lcns[j + i] = lrh->page_lcns[i]; } find_dp() only validates that target_vcn falls within [dp->vcn, dp->vcn + dp->lcns_follow), i.e., that the FIRST cluster is covered. The walk through the further entries is not bounded against dp->lcns_follow. For a malformed LRH where target_vcn = dp->vcn + dp->lcns_follow - 1 and lrh->lcns_follow > 1, the i > 0 writes overflow the dp's allocated page_lcns[] array. Add the missing j + lrh->lcns_follow <= dp->lcns_follow guard. Reproduced under UML+KASAN on mainline 8d90b09e6741 as a slab-out-of-bounds write of size 8 from log_replay+0x68d4 on the mount path. This is distinct from Pavitra Jha's 2026-05-02 patch ("fs/ntfs3: validate lcns_follow in log_replay conversion", <20260502154252.164586-1-jhapavitra98@gmail.com>) which addresses the separate version-0 dirty-page-table conversion path's memmove(&dp->vcn, ...) call. The two fixes are complementary; both should land. [almaz.alexandrovich@paragon-software.com: clang-formatted the changes, fixed conflicts]
Title		fs/ntfs3: bound copy_lcns dp->page_lcns[] index in analysis pass
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/0f13e823bf86bd1800168ea0bb5bca8b8500a81c https://git.kernel.org/stable/c/49c86dae0c0ccb8d98ddcdc46987259389c816dd https://git.kernel.org/stable/c/5e7b598660cfa8e5af172cf4c65cffc126333307 https://git.kernel.org/stable/c/9b3d8cc9d54fcded4de51b2b1026ae7182512077 https://git.kernel.org/stable/c/9b7c28d8c61bdb041936222a09a708531a1c2921 https://git.kernel.org/stable/c/d240cd98f5f7b65c90f6b2b6abe3232ccdc405ab

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-08-15T05:53:55.509Z

Updated: 2026-08-15T05:53:55.509Z

Reserved: 2026-08-09T03:40:39.911Z

Link: CVE-2026-72196

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-08-15T06:21:38.200

Modified: 2026-08-15T06:21:38.200

Link: CVE-2026-72196

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-08-15T19:45:12Z

Weaknesses

CWE-122

Tracking

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object