{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-72196","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2026-08-09T03:40:39.911Z","datePublished":"2026-08-15T05:53:55.509Z","dateUpdated":"2026-08-17T05:41:23.012Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-08-17T05:41:23.012Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nfs/ntfs3: bound copy_lcns dp->page_lcns[] index in analysis pass\n\nIn log_replay()'s analysis pass, after find_dp() returns a\nvalid DIR_PAGE_ENTRY for the (target_attr, target_vcn) tuple,\nthe copy_lcns block walks lrh->lcns_follow further entries:\n\n\tt16 = le16_to_cpu(lrh->lcns_follow);\n\tfor (i = 0; i < t16; i++) {\n\t    size_t j = (size_t)(le64_to_cpu(lrh->target_vcn) -\n\t                        le64_to_cpu(dp->vcn));\n\t    dp->page_lcns[j + i] = lrh->page_lcns[i];\n\t}\n\nfind_dp() only validates that target_vcn falls within\n[dp->vcn, dp->vcn + dp->lcns_follow), i.e., that the FIRST\ncluster is covered.  The walk through the further entries is\nnot bounded against dp->lcns_follow.  For a malformed LRH\nwhere target_vcn = dp->vcn + dp->lcns_follow - 1 and\nlrh->lcns_follow > 1, the i > 0 writes overflow the dp's\nallocated page_lcns[] array.\n\nAdd the missing j + lrh->lcns_follow <= dp->lcns_follow guard.\n\nReproduced under UML+KASAN on mainline 8d90b09e6741 as a\nslab-out-of-bounds write of size 8 from log_replay+0x68d4 on\nthe mount path.\n\nThis is distinct from Pavitra Jha's 2026-05-02 patch\n(\"fs/ntfs3: validate lcns_follow in log_replay conversion\",\n<20260502154252.164586-1-jhapavitra98@gmail.com>) which\naddresses the separate version-0 dirty-page-table conversion\npath's memmove(&dp->vcn, ...) call.  The two fixes are\ncomplementary; both should land.\n\n[almaz.alexandrovich@paragon-software.com: clang-formatted the changes,\nfixed conflicts]"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.4,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - The flaw is in ntfs3 log_replay() during mount when parsing a crafted $LogFile on a block device; exploitation requires a local mount syscall or auto-mount of attacker-supplied removable media, not delivery through a network-facing kernel protocol handler.\nAC:L - An attacker fully controls malicious NTFS $LogFile journal fields (target_vcn, lcns_follow, page_lcns) and can craft the dirty-page-table state; KASAN reliably reproduced the slab OOB write on mount with no races or attacker-uncontrollable conditions.\nPR:N - No account or privileges on the victim are needed when a crafted NTFS volume on removable media is auto-mounted by udisks/systemd as root; alternatively an unprivileged user can trigger replay via user-namespace mount with CAP_SYS_ADMIN.\nUI:N - Once an attacker mounts or causes mount of a crafted NTFS image, log_replay() runs automatically inside ntfs_fill_super() with no further user interaction; the vulnerable copy_lcns path is reached during standard journal analysis on every affected mount attempt.\nS:U - Exploitation corrupts kernel heap memory during ntfs3 journal replay in the mounting process context; impact is privilege escalation within the same kernel/host security boundary, not a VM-guest-to-host or IOMMU boundary crossing.\nC:H - KASAN confirmed a slab out-of-bounds write of 8 bytes past dp->page_lcns[] in a kmalloc-backed DIR_PAGE_ENTRY; such heap corruption can overwrite adjacent slab objects and be groomed into arbitrary kernel memory read primitives.\nI:H - The bug is an out-of-bounds write into kernel heap metadata or adjacent objects beyond the allocated page_lcns[] array; per kernel guidance OOB writes enable controlled heap corruption paths toward arbitrary kernel writes and privilege escalation.\nA:H - KASAN reported slab-out-of-bounds write from log_replay() on mount; heap corruption during journal replay can cause immediate kernel oops/panic and is repeatable on each mount of a malicious NTFS volume, constituting high availability impact."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/ntfs3/fslog.c"],"versions":[{"version":"b46acd6a6a627d876898e1c84d3f84902264b445","lessThan":"9b3d8cc9d54fcded4de51b2b1026ae7182512077","status":"affected","versionType":"git"},{"version":"b46acd6a6a627d876898e1c84d3f84902264b445","lessThan":"9b7c28d8c61bdb041936222a09a708531a1c2921","status":"affected","versionType":"git"},{"version":"b46acd6a6a627d876898e1c84d3f84902264b445","lessThan":"0f13e823bf86bd1800168ea0bb5bca8b8500a81c","status":"affected","versionType":"git"},{"version":"b46acd6a6a627d876898e1c84d3f84902264b445","lessThan":"d240cd98f5f7b65c90f6b2b6abe3232ccdc405ab","status":"affected","versionType":"git"},{"version":"b46acd6a6a627d876898e1c84d3f84902264b445","lessThan":"49c86dae0c0ccb8d98ddcdc46987259389c816dd","status":"affected","versionType":"git"},{"version":"b46acd6a6a627d876898e1c84d3f84902264b445","lessThan":"5e7b598660cfa8e5af172cf4c65cffc126333307","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/ntfs3/fslog.c"],"versions":[{"version":"5.15","status":"affected"},{"version":"0","lessThan":"5.15","status":"unaffected","versionType":"semver"},{"version":"6.1.178","lessThanOrEqual":"6.1.*","status":"unaffected","versionType":"semver"},{"version":"6.6.145","lessThanOrEqual":"6.6.*","status":"unaffected","versionType":"semver"},{"version":"6.12.97","lessThanOrEqual":"6.12.*","status":"unaffected","versionType":"semver"},{"version":"6.18.40","lessThanOrEqual":"6.18.*","status":"unaffected","versionType":"semver"},{"version":"7.1.5","lessThanOrEqual":"7.1.*","status":"unaffected","versionType":"semver"},{"version":"7.2","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.15","versionEndExcluding":"6.1.178"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.15","versionEndExcluding":"6.6.145"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.15","versionEndExcluding":"6.12.97"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.15","versionEndExcluding":"6.18.40"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.15","versionEndExcluding":"7.1.5"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.15","versionEndExcluding":"7.2"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/9b3d8cc9d54fcded4de51b2b1026ae7182512077"},{"url":"https://git.kernel.org/stable/c/9b7c28d8c61bdb041936222a09a708531a1c2921"},{"url":"https://git.kernel.org/stable/c/0f13e823bf86bd1800168ea0bb5bca8b8500a81c"},{"url":"https://git.kernel.org/stable/c/d240cd98f5f7b65c90f6b2b6abe3232ccdc405ab"},{"url":"https://git.kernel.org/stable/c/49c86dae0c0ccb8d98ddcdc46987259389c816dd"},{"url":"https://git.kernel.org/stable/c/5e7b598660cfa8e5af172cf4c65cffc126333307"}],"title":"fs/ntfs3: bound copy_lcns dp->page_lcns[] index in analysis pass","x_generator":{"engine":"bippy-1.2.0"}}}}