CVE-2026-72470

Status: UPDATED  |  Advisory ID: CVE-2026-72470

Key Details

Affected Products, Subsystems & Sectors

What to Know

In the Linux kernel, the following vulnerability has been resolved:

fs/ntfs3: resize log->one_page_buf when adopting on-disk page size

log_replay() allocates log->one_page_buf using the page size that was

chosen from the host PAGE_SIZE:

log->one_page_buf = kmalloc(log->page_size, GFP_NOFS);

Later, when a restart area is found, the log page size recorded on disk

is adopted:

t32 = le32_to_cpu(log->rst_info.r_page->sys_page_size);

if (log->page_size != t32) {

log->l_size = log->orig_file_size;

log->page_size = norm_file_page(t32, &log->l_size,

t32 == DefaultLogPageSize);

}

If the on-disk page size is larger than the size used for the initial

allocation, log->page_size grows but one_page_buf is left at its

original, smaller size. A subsequent unaligned read_log_page() then

reads log->page_size bytes into the undersized scratch buffer:

page_buf = page_off ? log->one_page_buf : *buffer;

err = ntfs_read_run_nb_ra(ni->mi.sbi, &ni->file.run, page_vbo, page_buf,

log->page_size, NULL, &log->read_ahead);

overflowing the allocation. This is reachable when mounting a dirty

NTFS volume whose log was formatted with a page size larger than the

buffer initially allocated on the mounting host (for example a 64K-log

volume mounted on a host that allocated a 4K scratch buffer).

Grow one_page_buf when the adopted on-disk page size exceeds the size

used for the initial allocation. On krealloc() failure the original

buffer is left intact and freed by the existing error path. (NVD)

What to Do

Monitor Linux's web page for any future patch releases.

References