https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 17:10:07 +0000 https://vulnerability.circl.lu/vuln/cve-2026-72205 <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>ntfs: free volume-wide resources on fill_super failure</p> <p>ntfs_fill_super()&#39;s err_out_now path frees only the volume struct via kfree(vol), leaving several vol-owned allocations behind on every mount failure:</p> <p>- vol-&gt;nls_map, loaded by ntfs_init_fs_context() via load_nls_default() (or replaced by an explicit nls= option in ntfs_parse_param()), is never unload_nls()&#39;d.</p> <p>- vol-&gt;volume_label, allocated by load_system_files() through ntfs_ucstonls() once the $Volume name attribute has been parsed, is not released by load_system_files()&#39;s own error labels nor by the fill_super() inline cleanup that only runs on d_make_root() failure. Any later failure inside load_system_files() leaks it.</p> <p>- vol-&gt;lcn_empty_bits_per_page was kvfree()&#39;d in unl_upcase_iput_tmp_ino_err_out_now without clearing the pointer, so it could not be folded into a single common cleanup.</p> <p>Because the failure paths never call ntfs_volume_free() and never reach the d_make_root() inline cleanup block (it sits above the label and is jumped over by the load_system_files() / kvmalloc failure gotos), these resources accumulate per failed mount attempt with no chance of recovery short of unloading the module. This is a silent leak: the inodes loaded prior to failure remain hashed but generic_shutdown_super() skips evict_inodes() when sb-&gt;s_root is unset, so no CHECK_DATA_CORRUPTION warning is emitted either.</p> <p>Move…</p> <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>ntfs: free volume-wide resources on fill_super failure</p> <p>ntfs_fill_super()&#39;s err_out_now path frees only the volume struct via kfree(vol), leaving several vol-owned allocations behind on every mount failure:</p> <p>- vol-&gt;nls_map, loaded by ntfs_init_fs_context() via load_nls_default() (or replaced by an explicit nls= option in ntfs_parse_param()), is never unload_nls()&#39;d.</p> <p>- vol-&gt;volume_label, allocated by load_system_files() through ntfs_ucstonls() once the $Volume name attribute has been parsed, is not released by load_system_files()&#39;s own error labels nor by the fill_super() inline cleanup that only runs on d_make_root() failure. Any later failure inside load_system_files() leaks it.</p> <p>- vol-&gt;lcn_empty_bits_per_page was kvfree()&#39;d in unl_upcase_iput_tmp_ino_err_out_now without clearing the pointer, so it could not be folded into a single common cleanup.</p> <p>Because the failure paths never call ntfs_volume_free() and never reach the d_make_root() inline cleanup block (it sits above the label and is jumped over by the load_system_files() / kvmalloc failure gotos), these resources accumulate per failed mount attempt with no chance of recovery short of unloading the module. This is a silent leak: the inodes loaded prior to failure remain hashed but generic_shutdown_super() skips evict_inodes() when sb-&gt;s_root is unset, so no CHECK_DATA_CORRUPTION warning is emitted either.</p> <p>Move…</p> https://vulnerability.circl.lu/vuln/cve-2026-72205