In the Linux kernel, the following vulnerability has been resolved:

fs/ntfs3: add bounds check to run_get_highest_vcn()

run_get_highest_vcn() parses a packed NTFS mapping-pairs buffer without
any length bound, relying solely on a 0x00 terminator to stop. A
crafted $LogFile UpdateMappingPairs record whose embedded attribute
contains mapping-pairs runs without a terminator causes the function to
read past the slab allocation, triggering a KASAN slab-out-of-bounds
read on mount.

The sibling function run_unpack() received an analogous bounds-check in
commit b62567bca474 ("ntfs3: add buffer boundary checks to run_unpack()"),
but run_get_highest_vcn() was missed.

Take a run_buf_size parameter and reject any run header whose payload
would extend past the buffer end, mirroring the pattern used by
run_unpack(). The caller in fslog.c passes the remaining attribute
bytes after the mapping-pairs offset.

KASAN report (on mainline v7.1 merge window HEAD):

BUG: KASAN: slab-out-of-bounds in run_get_highest_vcn+0x3c0/0x410
Read of size 1 at addr ffff88800e2d5400 by task mount/72
Call Trace:
run_get_highest_vcn+0x3c0/0x410
do_action.isra.0+0x3ba8/0x7b50
log_replay+0x9ddd/0x10200
ntfs_loadlog_and_replay+0x4ad/0x610
ntfs_fill_super+0x214a/0x4540

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
Linux Linux unaffected
Version Status Constraints
425de2aba0d061b3e715d51a3b1992c112ed5b99 affected < c69b9003332917b652175d5fa9d84158c5ed8617
bf7ac4a1d3bfc6e56e54635c3d331a68170d37c9 affected < 8afc24a884aff6a6f08028bd779ee65c40054455
e64f7dfcaff79e7dfff9121a382dd77f9b462f62 affected < c23083b472a720c3f60b147db05b25b751c7c1bf
d3012690a7065d9ca86521a525ad11e8af491d45 affected < a31893206588374d7d16fad387189d8165c7efd3
b62567bca47408e6739dee75f02a2113548af875 affected < 41081202eb823f5b27ff164b12010b24428100ad
b62567bca47408e6739dee75f02a2113548af875 affected < bb11485a87fbb2254b62cfed630b699d50e57da8
bbad75336870b51b81979b97613746237fcb02fe affected —
41aadf5cb482793a24e05aa136224e179a778586 affected —
6.1.175 affected < 6.1.178
6.6.140 affected < 6.6.145
6.12.86 affected < 6.12.97
6.18.27 affected < 6.18.40
5.15.209 affected < 5.16
7.0.4 affected < 7.1
Linux Linux affected
Version Status Constraints
7.1 affected —
0 unaffected < 7.1
6.1.178 unaffected ≤ 6.1.*
6.6.145 unaffected ≤ 6.6.*
6.12.97 unaffected ≤ 6.12.*
6.18.40 unaffected ≤ 6.18.*
7.1.5 unaffected ≤ 7.1.*
7.2-rc1 unaffected ≤ *

No data.

No data.

No data.

Project Subscriptions

Vendors Products
Linux Subscribe
Linux Kernel Subscribe
Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://git.kernel.org/stable/c/41081202eb823f5b27ff164b12010b24428100ad cve-icon cve-icon
https://git.kernel.org/stable/c/8afc24a884aff6a6f08028bd779ee65c40054455 cve-icon cve-icon
https://git.kernel.org/stable/c/a31893206588374d7d16fad387189d8165c7efd3 cve-icon cve-icon
https://git.kernel.org/stable/c/bb11485a87fbb2254b62cfed630b699d50e57da8 cve-icon cve-icon
https://git.kernel.org/stable/c/c23083b472a720c3f60b147db05b25b751c7c1bf cve-icon cve-icon
https://git.kernel.org/stable/c/c69b9003332917b652175d5fa9d84158c5ed8617 cve-icon cve-icon
History

Sat, 15 Aug 2026 06:00:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: add bounds check to run_get_highest_vcn() run_get_highest_vcn() parses a packed NTFS mapping-pairs buffer without any length bound, relying solely on a 0x00 terminator to stop. A crafted $LogFile UpdateMappingPairs record whose embedded attribute contains mapping-pairs runs without a terminator causes the function to read past the slab allocation, triggering a KASAN slab-out-of-bounds read on mount. The sibling function run_unpack() received an analogous bounds-check in commit b62567bca474 ("ntfs3: add buffer boundary checks to run_unpack()"), but run_get_highest_vcn() was missed. Take a run_buf_size parameter and reject any run header whose payload would extend past the buffer end, mirroring the pattern used by run_unpack(). The caller in fslog.c passes the remaining attribute bytes after the mapping-pairs offset. KASAN report (on mainline v7.1 merge window HEAD): BUG: KASAN: slab-out-of-bounds in run_get_highest_vcn+0x3c0/0x410 Read of size 1 at addr ffff88800e2d5400 by task mount/72 Call Trace: run_get_highest_vcn+0x3c0/0x410 do_action.isra.0+0x3ba8/0x7b50 log_replay+0x9ddd/0x10200 ntfs_loadlog_and_replay+0x4ad/0x610 ntfs_fill_super+0x214a/0x4540
Title fs/ntfs3: add bounds check to run_get_highest_vcn()
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-08-15T05:57:17.679Z

Reserved: 2026-08-09T03:40:39.935Z

Link: CVE-2026-72478

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-08-15T06:22:21.960

Modified: 2026-08-15T06:22:21.960

Link: CVE-2026-72478

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses

No weakness.