Skip to content
CVE PROGRAM SOURCE RECORD7.8 High

CVE-2026-72470

fs/ntfs3: resize log->one_page_buf when adopting on-disk page size

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Linux

Description

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: resize log->one_page_buf when adopting on-disk page size log_replay() allocates log->one_page_buf using the page size that was chosen from the host PAGE_SIZE: log->one_page_buf = kmalloc(log->page_size, GFP_NOFS); Later, when a restart area is found, the log page size recorded on disk is adopted: t32 = le32_to_cpu(log->rst_info.r_page->sys_page_size); if (log->page_size != t32) { log->l_size = log->orig_file_size; log->page_size = norm_file_page(t32, &log->l_size, t32 == DefaultLogPageSize); } If the on-disk page size is larger than the size used for the initial allocation, log->page_size grows but one_page_buf is left at its original, smaller size. A subsequent unaligned read_log_page() then reads log->page_size bytes into the undersized scratch buffer: page_buf = page_off ? log->one_page_buf : *buffer; err = ntfs_read_run_nb_ra(ni->mi.sbi, &ni->file.run, page_vbo, page_buf, log->page_size, NULL, &log->read_ahead); overflowing the allocation. This is reachable when mounting a dirty NTFS volume whose log was formatted with a page size larger than the buffer initially allocated on the mounting host (for example a 64K-log volume mounted on a host that allocated a 4K scratch buffer). Grow one_page_buf when the adopted on-disk page size exceeds the size used for the initial allocation. On krealloc() failure the original buffer is left intact and freed by the existing error path.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Linux Linux

Default version status: unaffected

  • b46acd6a6a627d876898e1c84d3f84902264b445 to < 220a6ef5e89a11ffd5e490046b86dc9fb6da0e4baffected
  • b46acd6a6a627d876898e1c84d3f84902264b445 to < 2097a2537d9d1c29c0e20ed0dbf717a0ccd8f374affected
  • b46acd6a6a627d876898e1c84d3f84902264b445 to < f1422df595d69b997d23a8f11e12c528ccef7fadaffected
  • b46acd6a6a627d876898e1c84d3f84902264b445 to < 4f129fc6f756f8541e5bff45b1804cc11b1ec712affected
  • b46acd6a6a627d876898e1c84d3f84902264b445 to < c99444f6dfca893f6d310aae4a53c620f98f7b4faffected
  • b46acd6a6a627d876898e1c84d3f84902264b445 to < 5a35454179fe1041d9cd286f5d320ce0d448c12aaffected

Linux Linux

Default version status: affected

  • 5.15affected
  • 0 to < 5.15unaffected
  • 6.1.191 to ≤ 6.1.*unaffected
  • 6.6.145 to ≤ 6.6.*unaffected
  • 6.12.97 to ≤ 6.12.*unaffected
  • 6.18.40 to ≤ 6.18.*unaffected
  • 7.1.5 to ≤ 7.1.*unaffected
  • 7.2 to ≤ *unaffected

References