Skip to content
Heist/ feed
High

fs/ntfs3: validate index entry key bounds

Type: advisorySource: Official CVE List1 source record

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: validate index entry key bounds [BUG] A malformed NTFS directory index entry can advertise a key_size larger than the bytes actually present in its NTFS_DE payload. Directory lookup then passes that malformed key to cmp_fnames(), which can read past the end of the kmalloc'ed index buffer. BUG: KASAN: slab-out-of-bounds in fname_full_size fs/ntfs3/ntfs.h:590 [inline] BUG: KASAN: slab-out-of-bounds in cmp_fnames+0x1ea/0x230 fs/ntfs3/index.c:46 Read of size 1 at addr ffff88801c313018 by task syz.6.3365/9279 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0xbe/0x130 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0xd1/0x650 mm/kasan/report.c:482 kasan_report+0xfb/0x140 mm/kasan/report.c:595 __asan_report_load1_noabort+0x14/0x30 mm/kasan/report_generic.c:378 fname_full_size fs/ntfs3/ntfs.h:590 [inline] cmp_fnames+0x1ea/0x230 fs/ntfs3/index.c:46 hdr_find_e.isra.0+0x3ed/0x670 fs/ntfs3/index.c:762 indx_find+0x4b5/0x900 fs/ntfs3/index.c:1186 dir_search_u+0x2c0/0x460 fs/ntfs3/dir.c:254 ntfs_lookup+0x1cc/0x2a0 fs/ntfs3/namei.c:85 __lookup_slow+0x241/0x450 fs/namei.c:1816 lookup_slow fs/namei.c:1833 [inline] walk_component+0x31c/0x570 fs/namei.c:2151 link_path_walk+0x592/0xd60 fs/namei.c:2519 path_lookupat+0x138/0x660 fs/namei.c:2675 filename_lookup+0x1f3/0x560 fs/namei.c:2705 filename_setxattr+0xad/0x1c0 fs/xattr.c:660 path_setxattrat+0x1d8/0x280

Announced Source revision 1
Original source ↗

CVE-2026-97438

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-97438

Linux

Source reference: /containers/cna/affected/0/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Linux

Source reference: /containers/cna/affected/1/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "vendor": "Linux",
    "product": "Linux",
    "versions": [
      {
        "status": "affected",
        "version": "82cae269cfa953032fbb8980a7d554d60fb00b17",
        "lessThan": "c8d93bc4823baecab3c39b877e16ac5f8d4d41ba",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "82cae269cfa953032fbb8980a7d554d60fb00b17",
        "lessThan": "7feeb424bda7f6ffaf5090cdd01b300eaa74c02b",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "82cae269cfa953032fbb8980a7d554d60fb00b17",
        "lessThan": "d564a885219a655077eefafeb72395a4580ebd69",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "82cae269cfa953032fbb8980a7d554d60fb00b17",
        "lessThan": "a8f4fb6a7d58974ffc9aed597401528b181d76dc",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "82cae269cfa953032fbb8980a7d554d60fb00b17",
        "lessThan": "0257e3ea00e19129f3ad5c039d8b8fdff0796835",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "82cae269cfa953032fbb8980a7d554d60fb00b17",
        "lessThan": "98d6e5d9dc1d34dcffc61549617581a5fe1ef807",
        "versionType": "git"
      }
    ],
    "programFiles": [
      "fs/ntfs3/fslog.c",
      "fs/ntfs3/index.c"
    ],
    "defaultStatus": "unaffected"
  },
  {
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "vendor": "Linux",
    "product": "Linux",
    "versions": [
      {
        "status": "affected",
        "version": "5.15"
      },
      {
        "status": "unaffected",
        "version": "0",
        "lessThan": "5.15",
        "versionType": "semver"
      },
      {
        "status": "unaffected",
        "version": "5.15.222",
        "versionType": "semver",
        "lessThanOrEqual": "5.15.*"
      },
      {
        "status": "unaffected",
        "version": "6.1.189",
        "versionType": "semver",
        "lessThanOrEqual": "6.1.*"
      },
      {
        "status": "unaffected",
        "version": "6.6.158",
        "versionType": "semver",
        "lessThanOrEqual": "6.6.*"
      },
      {
        "status": "unaffected",
        "version": "6.12.111",
        "versionType": "semver",
        "lessThanOrEqual": "6.12.*"
      },
      {
        "status": "unaffected",
        "version": "6.18.53",
        "versionType": "semver",
        "lessThanOrEqual": "6.18.*"
      },
      {
        "status": "unaffected",
        "version": "7.2",
        "versionType": "original_commit_for_fix",
        "lessThanOrEqual": "*"
      }
    ],
    "programFiles": [
      "fs/ntfs3/fslog.c",
      "fs/ntfs3/index.c"
    ],
    "defaultStatus": "affected"
  }
]
Related CVEs
CVE-2026-97438

Source reference: /cveMetadata/cveId

Publisher severity

high

Source reference: /containers/cna/metrics

Event
#8320 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement