CVE-2026-72470
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
In the Linux kernel's NTFS3 filesystem (fs/ntfs3), there is a buffer overflow vulnerability. During mounting of a dirty NTFS volume, log_replay() allocates one_page_buf using the host page size, then may adopt a larger on-disk page size from the restart area. If the on-disk page size is larger than the initial allocation, the buffer remains undersized, and a subsequent read of log->page_size bytes into it causes an overflow.
Risk Assessment
The vulnerability can lead to kernel memory corruption, potentially causing a system crash (kernel panic) or privilege escalation. Exploitation requires access to a specially crafted NTFS volume, which could be leveraged by a local user or when mounting untrusted media.
Recommendation
Immediately update the Linux kernel to a version containing the fix that grows one_page_buf (via krealloc) when the adopted on-disk page size is larger. Also avoid mounting untrusted NTFS volumes on systems with an unpatched kernel.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: resize log->one_page_buf when adopting on-disk page size log_replay() allocates log->one_page_buf using the page size that was chosen from the host PAGE_SIZE: log->one_page_buf = kmalloc(log->page_size, GFP_NOFS); Later, when a restart area is found, the log page size recorded on disk is adopted: t32 = le32_to_cpu(log->rst_info.r_page->sys_page_size); if (log->page_size != t32) { log->l_size = log->orig_file_size; log->page_size = norm_file_page(t32, &log->l_size, t32 == DefaultLogPageSize); } If the on-disk page size is larger than the size used for the initial allocation, log->page_size grows but one_page_buf is left at its original, smaller size. A subsequent unaligned read_log_page() then reads log->page_size bytes into the undersized scratch buffer: page_buf = page_off ? log->one_page_buf : *buffer; err = ntfs_read_run_nb_ra(ni->mi.sbi, &ni->file.run, page_vbo, page_buf, log->page_size, NULL, &log->read_ahead); overflowing the allocation. This is reachable when mounting a dirty NTFS volume whose log was formatted with a page size larger than the buffer initially allocated on the mounting host (for example a 64K-log volume mounted on a host that allocated a 4K scratch buffer). Grow one_page_buf when the adopted on-disk page size exceeds the size used for the initial allocation. On krealloc() failure the original buffer is left intact and freed by the existing error path.