{"id":"CVE-2026-72191","state":"PUBLISHED","title":"ntfs3: validate split-point offset in indx_insert_into_buffer","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nntfs3: validate split-point offset in indx_insert_into_buffer\n\nindx_insert_into_buffer() computes\n\n    used = used1 - to_copy - sp_size;\n    memmove(de_t, Add2Ptr(sp, sp_size), used - le32_to_cpu(hdr1->de_off));\n\nwhere sp and sp_size come from hdr_find_split().  hdr_find_split()\nwalks entries by le16_to_cpu(e->size) without validating that each\nstep stays within hdr->used or that the size field is at least\nsizeof(struct NTFS_DE).  index_hdr_check(), the on-load gatekeeper,\nonly validates header-level fields (used, total, de_off) and does\nnot walk per-entry sizes.\n\nA crafted NTFS image whose leaf INDEX_HDR reports used == total but\ncontains one interior NTFS_DE with size = 0xFFF0 therefore passes\nvalidation, descends to indx_insert_into_buffer() through the\nntfs_create() -> indx_insert_entry() path, and makes hdr_find_split()\nreturn an sp whose sp_size (0xFFF0) greatly exceeds the remaining\nbytes in the buffer.  The u32 subtraction underflows and the memmove\ncount becomes a near-4-GiB value, producing an out-of-bounds kernel\nwrite that corrupts adjacent allocations and panics the kernel.\n\nReproduced on 7.0.0-rc7 with UML + KASAN via a crafted image and a\nsingle 'touch' inside the mounted directory; crash site resolves to\nfs/ntfs3/index.c at the memmove.  Trigger requires only local mount\nof an attacker-supplied filesystem image (USB, loopback, or removable\nmedia auto-mount).\n\nReject the split whenever the chosen sp plus its declared size\nalready extends past hdr1->used.  This is the minimal fix; it\npreserves the existing hdr_find_split() contract and relies on the\nsame out: cleanup path as the pre-existing error returns.\n\nA prior OOB read in the very same indx_insert_into_buffer() memmove\nwas fixed in commit b8c44949044e (\"fs/ntfs3: Fix OOB read in\nindx_insert_into_buffer\") by tightening hdr_find_e(), but that fix\ndoes not cover the split-point size field path addressed here: sp is\nreturned by hdr_find_split(), not hdr_find_e(), and the underflow is\ndriven by sp->size rather than hdr->used exceeding hdr->total.","publishedAt":"2026-08-15T05:53:51.893Z","updatedAt":"2026-10-16T18:45:00.783Z","severity":{"score":9.8,"label":"Critical","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","source":"Linux"},"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"82cae269cfa953032fbb8980a7d554d60fb00b17","status":"affected","lessThan":"8e4ba5a38c155bb3c1c11e63cd285b178cdb099e","versionType":"git"},{"version":"82cae269cfa953032fbb8980a7d554d60fb00b17","status":"affected","lessThan":"4c2f648139a0a86f4486170f72e24fedd4fae74e","versionType":"git"},{"version":"82cae269cfa953032fbb8980a7d554d60fb00b17","status":"affected","lessThan":"b232eb5c9fe11ec2368e9b565db69c724c35fbd2","versionType":"git"},{"version":"82cae269cfa953032fbb8980a7d554d60fb00b17","status":"affected","lessThan":"7bf74e6baf810fe325f111996496c678fc6e244f","versionType":"git"},{"version":"82cae269cfa953032fbb8980a7d554d60fb00b17","status":"affected","lessThan":"f3624cc069195001c88df7a291af215f2133ff2c","versionType":"git"},{"version":"82cae269cfa953032fbb8980a7d554d60fb00b17","status":"affected","lessThan":"1758a564b6ebe7f4a82f23c9851d1cae15549457","versionType":"git"},{"version":"82cae269cfa953032fbb8980a7d554d60fb00b17","status":"affected","lessThan":"f1df9d771df47aa40de6d70949c28720ae1e430d","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/ntfs3/index.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"5.15","status":"affected"},{"version":"0","status":"unaffected","lessThan":"5.15","versionType":"semver"},{"version":"5.15.217","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.184","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.145","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.97","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.40","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.1.5","status":"unaffected","lessThanOrEqual":"7.1.*","versionType":"semver"},{"version":"7.2","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/ntfs3/index.c"]}],"references":["https://git.kernel.org/stable/c/8e4ba5a38c155bb3c1c11e63cd285b178cdb099e","https://git.kernel.org/stable/c/4c2f648139a0a86f4486170f72e24fedd4fae74e","https://git.kernel.org/stable/c/b232eb5c9fe11ec2368e9b565db69c724c35fbd2","https://git.kernel.org/stable/c/7bf74e6baf810fe325f111996496c678fc6e244f","https://git.kernel.org/stable/c/f3624cc069195001c88df7a291af215f2133ff2c","https://git.kernel.org/stable/c/1758a564b6ebe7f4a82f23c9851d1cae15549457","https://git.kernel.org/stable/c/f1df9d771df47aa40de6d70949c28720ae1e430d"],"weaknesses":[],"ingestedAt":"2026-10-29T20:12:58.252Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/72xxx/CVE-2026-72191.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-72191","state":"PUBLISHED","datePublished":"2026-08-15T05:53:51.893Z","dateUpdated":"2026-10-16T18:45:00.783Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2026-08-09T03:40:39.911Z"},"containers":{"cna":{"title":"ntfs3: validate split-point offset in indx_insert_into_buffer","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nntfs3: validate split-point offset in indx_insert_into_buffer\n\nindx_insert_into_buffer() computes\n\n    used = used1 - to_copy - sp_size;\n    memmove(de_t, Add2Ptr(sp, sp_size), used - le32_to_cpu(hdr1->de_off));\n\nwhere sp and sp_size come from hdr_find_split().  hdr_find_split()\nwalks entries by le16_to_cpu(e->size) without validating that each\nstep stays within hdr->used or that the size field is at least\nsizeof(struct NTFS_DE).  index_hdr_check(), the on-load gatekeeper,\nonly validates header-level fields (used, total, de_off) and does\nnot walk per-entry sizes.\n\nA crafted NTFS image whose leaf INDEX_HDR reports used == total but\ncontains one interior NTFS_DE with size = 0xFFF0 therefore passes\nvalidation, descends to indx_insert_into_buffer() through the\nntfs_create() -> indx_insert_entry() path, and makes hdr_find_split()\nreturn an sp whose sp_size (0xFFF0) greatly exceeds the remaining\nbytes in the buffer.  The u32 subtraction underflows and the memmove\ncount becomes a near-4-GiB value, producing an out-of-bounds kernel\nwrite that corrupts adjacent allocations and panics the kernel.\n\nReproduced on 7.0.0-rc7 with UML + KASAN via a crafted image and a\nsingle 'touch' inside the mounted directory; crash site resolves to\nfs/ntfs3/index.c at the memmove.  Trigger requires only local mount\nof an attacker-supplied filesystem image (USB, loopback, or removable\nmedia auto-mount).\n\nReject the split whenever the chosen sp plus its declared size\nalready extends past hdr1->used.  This is the minimal fix; it\npreserves the existing hdr_find_split() contract and relies on the\nsame out: cleanup path as the pre-existing error returns.\n\nA prior OOB read in the very same indx_insert_into_buffer() memmove\nwas fixed in commit b8c44949044e (\"fs/ntfs3: Fix OOB read in\nindx_insert_into_buffer\") by tightening hdr_find_e(), but that fix\ndoes not cover the split-point size field path addressed here: sp is\nreturned by hdr_find_split(), not hdr_find_e(), and the underflow is\ndriven by sp->size rather than hdr->used exceeding hdr->total."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"82cae269cfa953032fbb8980a7d554d60fb00b17","status":"affected","lessThan":"8e4ba5a38c155bb3c1c11e63cd285b178cdb099e","versionType":"git"},{"version":"82cae269cfa953032fbb8980a7d554d60fb00b17","status":"affected","lessThan":"4c2f648139a0a86f4486170f72e24fedd4fae74e","versionType":"git"},{"version":"82cae269cfa953032fbb8980a7d554d60fb00b17","status":"affected","lessThan":"b232eb5c9fe11ec2368e9b565db69c724c35fbd2","versionType":"git"},{"version":"82cae269cfa953032fbb8980a7d554d60fb00b17","status":"affected","lessThan":"7bf74e6baf810fe325f111996496c678fc6e244f","versionType":"git"},{"version":"82cae269cfa953032fbb8980a7d554d60fb00b17","status":"affected","lessThan":"f3624cc069195001c88df7a291af215f2133ff2c","versionType":"git"},{"version":"82cae269cfa953032fbb8980a7d554d60fb00b17","status":"affected","lessThan":"1758a564b6ebe7f4a82f23c9851d1cae15549457","versionType":"git"},{"version":"82cae269cfa953032fbb8980a7d554d60fb00b17","status":"affected","lessThan":"f1df9d771df47aa40de6d70949c28720ae1e430d","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/ntfs3/index.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"5.15","status":"affected"},{"version":"0","status":"unaffected","lessThan":"5.15","versionType":"semver"},{"version":"5.15.217","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.184","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.145","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.97","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.40","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.1.5","status":"unaffected","lessThanOrEqual":"7.1.*","versionType":"semver"},{"version":"7.2","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/ntfs3/index.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/8e4ba5a38c155bb3c1c11e63cd285b178cdb099e"},{"url":"https://git.kernel.org/stable/c/4c2f648139a0a86f4486170f72e24fedd4fae74e"},{"url":"https://git.kernel.org/stable/c/b232eb5c9fe11ec2368e9b565db69c724c35fbd2"},{"url":"https://git.kernel.org/stable/c/7bf74e6baf810fe325f111996496c678fc6e244f"},{"url":"https://git.kernel.org/stable/c/f3624cc069195001c88df7a291af215f2133ff2c"},{"url":"https://git.kernel.org/stable/c/1758a564b6ebe7f4a82f23c9851d1cae15549457"},{"url":"https://git.kernel.org/stable/c/f1df9d771df47aa40de6d70949c28720ae1e430d"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL"},"scenarios":[{"lang":"en","value":"AV:N - Remote SMB CREATE via ksmbd vfs_create on an ntfs3-exported share reaches ntfs_create_inode→indx_insert_entry→indx_insert_into_buffer; the same memmove path is also reachable locally via open(O_CREAT)/touch on a mounted crafted image.\nAC:L - The attacker fully controls the on-disk leaf INDEX_HDR and NTFS_DE size (e.g. 0xFFF0); once the buffer is full and a create forces a split, hdr_find_split() deterministically selects the bad entry and the u32 underflow yields a reliable near-4GiB OOB memmove with no race.\nPR:N - Exploitation requires only a crafted NTFS image and a create in the malicious directory—no root on the target—via udisks2/systemd automount of attacker USB media, or a remote ksmbd client with guest/anonymous write access to an already-mounted ntfs3 export.\nUI:N - After the crafted volume is mounted (automounter or admin), a single attacker-initiated touch/create or remote SMB CREATE in the prepared full directory triggers the split and OOB memmove without any further victim clicks, prompts, or confirmation.\nS:U - The OOB memmove corrupts kernel heap memory within the same host OS security domain as ntfs3; it can enable local privilege escalation but does not cross a VM/hypervisor, IOMMU, or container sandbox boundary.\nC:H - The underflowed memmove length reads far beyond the kmalloc'd index buffer from attacker-controlled on-disk bytes, giving a large out-of-bounds kernel heap read and disclosure/corruption primitive in addition to the write side.\nI:H - The same memmove performs a massive out-of-bounds kernel heap write of adjacent slab objects with attacker-influenced source data, enabling arbitrary memory corruption and potential control-flow hijack beyond a simple denial of service.\nA:H - Reproduced on 7.0.0-rc7 with KASAN: the oversized memmove corrupts adjacent allocations and panics the kernel at fs/ntfs3/index.c; even failed exploitation attempts typically cause oops or hard lockup from the unbounded copy."}]}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-08-23T12:47:01.444Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.15","versionEndExcluding":"5.15.217"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.15","versionEndExcluding":"6.1.184"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.15","versionEndExcluding":"6.6.145"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.15","versionEndExcluding":"6.12.97"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.15","versionEndExcluding":"6.18.40"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.15","versionEndExcluding":"7.1.5"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.15","versionEndExcluding":"7.2"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-72191","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-16T18:43:30.355468Z"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-10-16T18:45:00.783Z"}}]}}}