{"cve":"CVE-2026-72195","nvd":{"published":"2026-08-15T06:21:38.077","modified":"2026-10-16T19:17:14.013","status":"Received","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nfs/ntfs3: bound attr_off in UpdateResidentValue against data_off\n\nIn do_action()'s UpdateResidentValue case (fslog.c:3307),\nlrh->attr_off and lrh->redo_len come from the on-disk LRH.\nWhen they satisfy aoff + dlen < attr->res.data_off, the\nassignment\n\n\tattr->res.data_size = cpu_to_le32(aoff + dlen - data_off);\n\nunderflows to ~4 GiB (e.g. 0xFFFFFFF9 when aoff=0x10, dlen=1,\ndata_off=0x18).  Subsequent code that reads attr->res.data_size\nto walk the resident attribute payload would then read up to\n4 GiB past the 1024-byte MFT record allocation.\n\nThe existing mi_enum_attr() defense in fs/ntfs3/record.c:287\ncatches the corrupted data_size on the next attribute walk\nand fails the mount, but only on the path that walks all\nattributes.  A read site that picks an attribute by name and\nreads its data_size without re-validating is not covered.\nValidate aoff against data_off and asize at the source.\n\nReproduced under UML+KASAN on mainline 8d90b09e6741 via\npr_warn-only probe: with aoff=0x10 and data_off=0x18, the\npost-assignment data_size is 0xfffffff9 (mount then fails\nat -22 from mi_enum_attr).\n\n[almaz.alexandrovich@paragon-software.com: clang-formatted the changes]","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":7.8},"cwes":[],"references":["https://git.kernel.org/stable/c/50b5e83384e7fed3d11d18b79ff350e9d6d89861","https://git.kernel.org/stable/c/53c12f178f584dc5f836ffe2782138a6e9348ed9","https://git.kernel.org/stable/c/546518468e6c9ea469669eef78f8cc380ad6e2ca","https://git.kernel.org/stable/c/97758fd9756b5f09e9ddc6a5f6a569041acc8421","https://git.kernel.org/stable/c/a89c66674283a0293c0f266dc57087a6114371a3"],"products":[],"source":"nvd","synced_at":"2026-10-19T22:48:17.459049833+00:00"},"epss":{"cve":"CVE-2026-72195","score":0.00169,"percentile":0.06194,"date":"2026-10-25"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}