Look up another CVE · open CVE-2026-72478 in the interactive tracker
CVE-2026-72478
fs/ntfs3: add bounds check to run_get_highest_vcn()
Published 2026-08-15 (2 months ago) by the Linux kernel CNA. Subsystem fs/ntfs3. Debian urgency: not yet assigned.
What to do, per Debian release
Debian's own status for CVE-2026-72478 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source
| Release | Status | Version | What this means |
|---|---|---|---|
| Debian 12bookworm | fixed | 6.1.180-1 | Update the kernel and reboot. Fixed in 6.1.180-1. A running kernel keeps the old code until the machine restarts. |
| Debian 13trixie | fixed | 6.12.100-1 | Update the kernel and reboot. Fixed in 6.12.100-1. A running kernel keeps the old code until the machine restarts. |
| Debian 14forky | fixed | 7.1.5-1 | Update the kernel and reboot. Fixed in 7.1.5-1. A running kernel keeps the old code until the machine restarts. |
| Debian unstablesid | fixed | 7.1.5-1 | Update the kernel and reboot. Fixed in 7.1.5-1. A running kernel keeps the old code until the machine restarts. |
The vulnerability
What the bug is
run_get_highest_vcn() parses a packed NTFS mapping-pairs buffer without any length bound, relying solely on a 0x00 terminator to stop. A crafted $LogFile UpdateMappingPairs record whose embedded attribute contains mapping-pairs runs without a terminator causes the function to read past the slab allocation, triggering a KASAN slab-out-of-bounds read on mount. The sibling function run_unpack() received an analogous bounds-check in commit b62567bca474 ("ntfs3: add buffer boundary checks to run_unpack()"), but run_get_highest_vcn() was missed. Take a run_buf_size parameter and reject any run header whose payload would extend past the buffer end, mirroring the pattern used by run_unpack(). The caller in fslog.c passes the remaining attribute bytes after the mapping-pairs offset. KASAN report (on mainline v7.1 merge window HEAD): BUG: KASAN: slab-out-of-bounds in run_get_highest_vcn+0x3c0/0x410 Read of size 1 at addr ffff88800e2d5400 by task mount/72 Call Trace: run_get_highest_vcn+0x3c0/0x410 do_action.isra.0+0x3ba8/0x7b50 log_replay+0x9ddd/0x10200 ntfs_loadlog_and_replay+0x4ad/0x610 ntfs_fill_super+0x214a/0x4540
Where it lives
The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.
fs/ntfs3/fslog.c
fs/ntfs3/ntfs_fs.h
fs/ntfs3/run.c
- What this is
- NTFS3 FILESYSTEMMAINTAINERS section matched on fs/ntfs3/ · ntfs3@lists.linux.dev · Supported
- Kernel module
- ntfs3
Check it on the machine
grep -w CONFIG_NTFS3_FS /boot/config-$(uname -r)Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.
lsmod | grep -w ntfs3Prints a line if that module is loaded right now, and nothing if it is not. One that is not loaded can still be loaded later by anything that needs it.
Show whether Debian builds this, per release
Debian does not build this code in 3 releases. It does build it in 1 release, so the answer depends on which release the machine runs.
- bookwormn
- trixiem
- forky, sidn
- n
- not enabled on any flavour - this release does not build the code
- m
- a loadable module on every flavour - check lsmod, can be blacklisted
- Build switch
- CONFIG_NTFS3_FS
From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages
Signals
- Published
- 2026-08-15 (2 months ago)source
- CVSS
- 8.4 high
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsource recompute it - Attack vector
- local (AV:L)source
- EPSS
- 0.20%, higher than 8.6% of all CVEssource
- CISA KEV
- not listedthe KEV catalogue
- Debian urgency
- not yet assignedsource
- Subsystem
- fs/ntfs3
Upstream fixes
The versions the CNA records as introducing and fixing this, and the commit for each. source
| Introduced | Fixed in | Commit |
|---|---|---|
| 6.1.175 | 6.1.178 | c69b90033329 |
| 6.6.140 | 6.6.145 | 8afc24a884af |
| 6.12.86 | 6.12.97 | c23083b472a7 |
| 6.18.27 | 6.18.40 | a31893206588 |
| 7.1 | 7.1.5 | 41081202eb82 |
| 7.1 | 7.2 | bb11485a87fb |
| 5.15.209 | 0 | 0 |
| 7.0.4 | 0 | 0 |
Why the CNA scored it this way
Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source
- AV:LAttack vector, local
- mount(2)/get_tree_bdev on a crafted NTFS block device or loop image reaches ntfs_fill_super()→ntfs_loadlog_and_replay()→log_replay()→do_action(UpdateMappingPairs)→run_get_highest_vcn(); no network handler parses $LogFile.
- AC:LAttack complexity, low
- The attacker fully controls the on-disk $LogFile UpdateMappingPairs record and embedded non-resident mapping-pairs bytes; omitting the 0x00 terminator deterministically drives the unbounded parser past the attribute buffer on the first replay mount with no race.
- PR:NPrivileges required, none
- The attacker needs no account or privilege on the victim; supplying a malicious NTFS image on USB/removable media, a disk image, or shared storage is sufficient for udisks2/systemd automount or an administrator mount to reach journal replay.
- UI:NUser interaction, none
- Desktop/kiosk/shared-workstation automounters mount attacker-supplied NTFS media and run $LogFile replay without the user opening files or running commands; insertion of the crafted volume is sufficient to trigger parsing on mount.
- S:UScope, unchanged
- Slab out-of-bounds reads and resulting mount-time kernel faults stay within the host kernel security authority; no VM escape, IOMMU bypass, or cross-boundary scope change.
- C:HConfidentiality impact, high
- run_get_highest_vcn() scans mapping pairs with no length bound, performing slab out-of-bounds byte reads via run_unpack_s64(); kernel guidance treats heap out-of-bounds reads as enabling broad adjacent-slab information disclosure.
- I:HIntegrity impact, high
- Parsed run lengths and offsets come from attacker-chosen and out-of-bounds heap bytes and, if the loop terminates, are written into attr->nres.evcn during log replay, corrupting non-resident extent metadata and redirecting later replayed cluster I/O.
- A:HAvailability impact, high
- The demonstrated KASAN slab-out-of-bounds read in the mount task can fault into unmapped adjacent memory, producing a kernel oops/panic and denying service until reboot.