Vulnerability-Lookup

FKIE_CVE-2026-97437

Vulnerability from fkie_nvd - Published: 2026-09-24 17:17 - Updated: 2026-09-25 13:17

Severity

7.1 (High) - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H

Summary

In the Linux kernel, the following vulnerability has been resolved: ntfs3: fix out-of-bounds read in ntfs_dir_emit() and hdr_find_e() The bounds check in ntfs_dir_emit() compares fname->name_len (a character count) against e->size (a byte count) without accounting for the 2-byte-per-character UTF-16LE encoding or the ATTR_FILE_NAME header size: if (fname->name_len + sizeof(struct NTFS_DE) > le16_to_cpu(e->size)) This computes: name_len + 16 > e_size The correct check must account for the ATTR_FILE_NAME header (66 bytes before the name) and the UTF-16LE character size (2 bytes each): sizeof(NTFS_DE) + offsetof(ATTR_FILE_NAME, name) + name_len * sizeof(short) > e_size Which computes: 16 + 66 + name_len * 2 > e_size The correct calculation already exists as fname_full_size() in ntfs.h and is used in cmp_fnames(), namei.c, and fslog.c, but was not used in the readdir path. A crafted NTFS image with an index entry containing a small e->size but large fname->name_len bypasses the current check, causing ntfs_utf16_to_nls() to read past the entry boundary. Additionally, add a key_size validation in hdr_find_e() to ensure the declared key_size does not exceed the available entry data, preventing comparison functions from reading past entry boundaries on the lookup path.

References

	URL	Tags
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/6a8149a20e46086c756c2a9202e377c0b649a0c3
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/aa1bdbb39f49c5bc9779316891c40005517842a5
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/ed6da1abeec50db9060d714f03743fe0b63e4fe4

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/ntfs3/dir.c",
            "fs/ntfs3/index.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "ed6da1abeec50db9060d714f03743fe0b63e4fe4",
              "status": "affected",
              "version": "4342306f0f0d5ff4315a204d315c1b51b914fca5",
              "versionType": "git"
            },
            {
              "lessThan": "6a8149a20e46086c756c2a9202e377c0b649a0c3",
              "status": "affected",
              "version": "4342306f0f0d5ff4315a204d315c1b51b914fca5",
              "versionType": "git"
            },
            {
              "lessThan": "aa1bdbb39f49c5bc9779316891c40005517842a5",
              "status": "affected",
              "version": "4342306f0f0d5ff4315a204d315c1b51b914fca5",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/ntfs3/dir.c",
            "fs/ntfs3/index.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.15"
            },
            {
              "lessThan": "5.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.111",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.53",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nntfs3: fix out-of-bounds read in ntfs_dir_emit() and hdr_find_e()\n\nThe bounds check in ntfs_dir_emit() compares fname-\u003ename_len (a\ncharacter count) against e-\u003esize (a byte count) without accounting\nfor the 2-byte-per-character UTF-16LE encoding or the ATTR_FILE_NAME\nheader size:\n\n  if (fname-\u003ename_len + sizeof(struct NTFS_DE) \u003e le16_to_cpu(e-\u003esize))\n\nThis computes: name_len + 16 \u003e e_size\n\nThe correct check must account for the ATTR_FILE_NAME header (66 bytes\nbefore the name) and the UTF-16LE character size (2 bytes each):\n\n  sizeof(NTFS_DE) + offsetof(ATTR_FILE_NAME, name) +\n  name_len * sizeof(short) \u003e e_size\n\nWhich computes: 16 + 66 + name_len * 2 \u003e e_size\n\nThe correct calculation already exists as fname_full_size() in ntfs.h\nand is used in cmp_fnames(), namei.c, and fslog.c, but was not used\nin the readdir path.\n\nA crafted NTFS image with an index entry containing a small e-\u003esize\nbut large fname-\u003ename_len bypasses the current check, causing\nntfs_utf16_to_nls() to read past the entry boundary.\n\nAdditionally, add a key_size validation in hdr_find_e() to ensure the\ndeclared key_size does not exceed the available entry data, preventing\ncomparison functions from reading past entry boundaries on the lookup\npath."
    }
  ],
  "id": "CVE-2026-97437",
  "lastModified": "2026-09-25T13:17:27.300",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 7.1,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 5.2,
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-09-24T17:17:21.810",
  "references": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/6a8149a20e46086c756c2a9202e377c0b649a0c3"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/aa1bdbb39f49c5bc9779316891c40005517842a5"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/ed6da1abeec50db9060d714f03743fe0b63e4fe4"
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "vulnStatus": "Received"
}

CVE-2026-97437 (GCVE-0-2026-97437)

Vulnerability from cvelistv5 – Published: 2026-09-24 16:03 – Updated: 2026-09-25 12:44

Title

ntfs3: fix out-of-bounds read in ntfs_dir_emit() and hdr_find_e()

Summary

Severity

7.1 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H

Assigner

Linux mitre root

References

3 references

URL	Tags
https://git.kernel.org/stable/c/ed6da1abeec50db90…
https://git.kernel.org/stable/c/6a8149a20e46086c7…
https://git.kernel.org/stable/c/aa1bdbb39f49c5bc9…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 4342306f0f0d5ff4315a204d315c1b51b914fca5 , < ed6da1abeec50db9060d714f03743fe0b63e4fe4 (git) Affected: 4342306f0f0d5ff4315a204d315c1b51b914fca5 , < 6a8149a20e46086c756c2a9202e377c0b649a0c3 (git) Affected: 4342306f0f0d5ff4315a204d315c1b51b914fca5 , < aa1bdbb39f49c5bc9779316891c40005517842a5 (git)
Linux	Linux	Affected: 5.15 Unaffected: 0 , < 5.15 (semver) Unaffected: 6.12.111 , ≤ 6.12.* (semver) Unaffected: 6.18.53 , ≤ 6.18.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/ntfs3/dir.c",
            "fs/ntfs3/index.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "ed6da1abeec50db9060d714f03743fe0b63e4fe4",
              "status": "affected",
              "version": "4342306f0f0d5ff4315a204d315c1b51b914fca5",
              "versionType": "git"
            },
            {
              "lessThan": "6a8149a20e46086c756c2a9202e377c0b649a0c3",
              "status": "affected",
              "version": "4342306f0f0d5ff4315a204d315c1b51b914fca5",
              "versionType": "git"
            },
            {
              "lessThan": "aa1bdbb39f49c5bc9779316891c40005517842a5",
              "status": "affected",
              "version": "4342306f0f0d5ff4315a204d315c1b51b914fca5",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/ntfs3/dir.c",
            "fs/ntfs3/index.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.15"
            },
            {
              "lessThan": "5.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.111",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.53",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.111",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.53",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nntfs3: fix out-of-bounds read in ntfs_dir_emit() and hdr_find_e()\n\nThe bounds check in ntfs_dir_emit() compares fname-\u003ename_len (a\ncharacter count) against e-\u003esize (a byte count) without accounting\nfor the 2-byte-per-character UTF-16LE encoding or the ATTR_FILE_NAME\nheader size:\n\n  if (fname-\u003ename_len + sizeof(struct NTFS_DE) \u003e le16_to_cpu(e-\u003esize))\n\nThis computes: name_len + 16 \u003e e_size\n\nThe correct check must account for the ATTR_FILE_NAME header (66 bytes\nbefore the name) and the UTF-16LE character size (2 bytes each):\n\n  sizeof(NTFS_DE) + offsetof(ATTR_FILE_NAME, name) +\n  name_len * sizeof(short) \u003e e_size\n\nWhich computes: 16 + 66 + name_len * 2 \u003e e_size\n\nThe correct calculation already exists as fname_full_size() in ntfs.h\nand is used in cmp_fnames(), namei.c, and fslog.c, but was not used\nin the readdir path.\n\nA crafted NTFS image with an index entry containing a small e-\u003esize\nbut large fname-\u003ename_len bypasses the current check, causing\nntfs_utf16_to_nls() to read past the entry boundary.\n\nAdditionally, add a key_size validation in hdr_find_e() to ensure the\ndeclared key_size does not exceed the available entry data, preventing\ncomparison functions from reading past entry boundaries on the lookup\npath."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The attacker-controlled bytes are on-disk NTFS_DE.size, ATTR_FILE_NAME.name_len and NTFS_DE.key_size. getdents64\u2192iterate_dir\u2192ntfs_readdir\u2192ntfs_read_hdr\u2192ntfs_dir_emit() and ntfs_lookup/ntfs_fill_super\u2192ntfs_extend_init\u2192dir_search_u\u2192indx_find\u2192hdr_find_e() consume those fields; no SMB, NFS, or TCP message carries them.\nAC:L - A crafted index entry with e-\u003esize \u003e= name_len+sizeof(NTFS_DE) but smaller than sizeof(NTFS_DE)+offsetof(ATTR_FILE_NAME,name)+name_len*2 bypasses the old ntfs_dir_emit() check so ntfs_utf16_to_nls() over-reads on every readdir of that directory; the same image can set key_size \u003e e-\u003esize-sizeof(NTFS_DE) so hdr_find_e() passes an oversized key to cmp_fnames(). No race.\nPR:N - Crafting the NTFS image needs no host account. ntfs_fs_type.fs_flags is only FS_REQUIRES_DEV|FS_ALLOW_IDMAP (no FS_USERNS_MOUNT), so mount_capable() requires init-namespace CAP_SYS_ADMIN; that mount is scored as UI:R, not attacker privilege. ntfs_dir_emit() and hdr_find_e() have no capable() gate after the volume is mounted.\nUI:R - The bad name_len and key_size are inert on-disk until a victim or automount helper mounts the image via path_mount\u2192get_tree_bdev\u2192ntfs_fill_super. That mount is the required user action; ntfs_extend_init() even calls dir_search_u()\u2192hdr_find_e() during fill_super, and a subsequent getdents reaches ntfs_dir_emit().\nS:U - The over-read in ntfs_utf16_to_nls()/cmp_fnames() and any oops stay in the host kernel that mounted the volume. This is not a KVM/Xen guest-to-host escape or an IOMMU/DMA boundary bypass.\nC:H - ntfs_dir_emit() hands attacker-chosen fname-\u003ename_len (u8, up to 255 UTF-16 units) to ntfs_utf16_to_nls() after a check that ignores the 66-byte ATTR_FILE_NAME header and 2-byte encoding, so up to ~321 bytes past the NTFS_DE\u2014and past indx_read()\u0027s kmalloc(1\u003c\u003cindex_bits) if the entry is at the buffer tail\u2014are converted and dir_emit()\u0027d into getdents. hdr_find_e() likewise lets cmp_fnames() read past that slab.\nI:N - ntfs_utf16_to_nls() writes only into the PATH_MAX buffer kmalloc\u0027d by ntfs_readdir(); dir_emit()/filldir() then copy that name to the user dirent. hdr_find_e\u0027s cmp_fnames() returns only a comparison integer. Neither path is an out-of-bounds write, UAF, or control-flow hijack.\nA:H - indx_read() kmallocs 1\u003c\u003cindex_bits (typically 4K) for the INDEX_BUFFER. An entry near the end with name_len=255, or key_size larger than the remaining payload, makes ntfs_utf16_to_nls() or fname_full_size() in cmp_fnames() read off that object, which can fault unmapped adjacent pages and oops the kernel."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-25T12:44:14.325Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/ed6da1abeec50db9060d714f03743fe0b63e4fe4"
        },
        {
          "url": "https://git.kernel.org/stable/c/6a8149a20e46086c756c2a9202e377c0b649a0c3"
        },
        {
          "url": "https://git.kernel.org/stable/c/aa1bdbb39f49c5bc9779316891c40005517842a5"
        }
      ],
      "title": "ntfs3: fix out-of-bounds read in ntfs_dir_emit() and hdr_find_e()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-97437",
    "datePublished": "2026-09-24T16:03:50.105Z",
    "dateReserved": "2026-09-24T14:53:16.869Z",
    "dateUpdated": "2026-09-25T12:44:14.325Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

FKIE_CVE-2026-97437

CVE-2026-97437 (GCVE-0-2026-97437)

Tags

Sightings

Nomenclature

Related by attack behaviour