Answer in brief
CVE-2026-72195 records a High severity (CVSS 7.8) vulnerability in fs/ntfs3: bound attr_off in UpdateResidentValue against data_off. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 7.8. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=b46acd6a6a627d876898e1c84d3f84902264b445 <ab8761676d638c5be170aaf91b7ffdd451236616 || >=b46acd6a6a627d876898e1c84d3f84902264b445 <53c12f178f584dc5f836ffe2782138a6e9348ed9 || >=b46acd6a6a627d876898e1c84d3f84902264b445 <546518468e6c9ea469669eef78f8cc380ad6e2ca || >=b46acd6a6a627d876898e1c84d3f84902264b445 <97758fd9756b5f09e9ddc6a5f6a569041acc8421 || >=b46acd6a6a627d876898e1c84d3f84902264b445 <50b5e83384e7fed3d11d18b79ff350e9d6d89861 || >=b46acd6a6a627d876898e1c84d3f84902264b445 <a89c66674283a0293c0f266dc57087a6114371a3 || >=b46acd6a6a627d876898e1c84d3f84902264b445 <d1570c48f49a693974d000251030370ee2e83539 | ab8761676d638c5be170aaf91b7ffdd451236616, 53c12f178f584dc5f836ffe2782138a6e9348ed9, 546518468e6c9ea469669eef78f8cc380ad6e2ca, 97758fd9756b5f09e9ddc6a5f6a569041acc8421, 50b5e83384e7fed3d11d18b79ff350e9d6d89861, a89c66674283a0293c0f266dc57087a6114371a3, d1570c48f49a693974d000251030370ee2e83539 |
| Linux/Linuxgeneric | 5.15 | Not reported |
Published upstream
Aug 15, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 17, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 15, 2026
In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: bound attr_off in UpdateResidentValue against data_off In do_action()'s UpdateResidentValue case (fslog.c:3307), lrh->attr_off and lrh->redo_len come from the on-disk LRH. When they satisfy aoff + dlen < attr->res.data_off, the assignment attr->res.data_size = cpu_to_le32(aoff + dlen - data_off); underflows to ~4 GiB (e.g. 0xFFFFFFF9 when aoff=0x10, dlen=1, data_off=0x18). Subsequent code that reads attr->res.data_size to walk the resident attribute payload would then read up to 4 GiB past the 1024-byte MFT record allocation. The existing mi_enum_attr() defense in fs/ntfs3/record.c:287 catches the corrupted data_size on the next attribute walk and fails the mount, but only on the path that walks all attributes. A read site that picks an attribute by name and reads its data_size without re-validating is not covered. Validate aoff against data_off and asize at the source. Reproduced under UML+KASAN on mainline 8d90b09e6741 via pr_warn-only probe: with aoff=0x10 and data_off=0x18, the post-assignment data_size is 0xfffffff9 (mount then fails at -22 from mi_enum_attr). [[email protected]: clang-formatted the changes]
Quoted source text, attributed separately from HOL analysis.