FKIE_CVE-2026-97438

Vulnerability from fkie_nvd - Published: 2026-09-24 17:17 - Updated: 2026-09-25 13:17
Severity
7.1 (High) - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: validate index entry key bounds [BUG] A malformed NTFS directory index entry can advertise a key_size larger than the bytes actually present in its NTFS_DE payload. Directory lookup then passes that malformed key to cmp_fnames(), which can read past the end of the kmalloc'ed index buffer. BUG: KASAN: slab-out-of-bounds in fname_full_size fs/ntfs3/ntfs.h:590 [inline] BUG: KASAN: slab-out-of-bounds in cmp_fnames+0x1ea/0x230 fs/ntfs3/index.c:46 Read of size 1 at addr ffff88801c313018 by task syz.6.3365/9279 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0xbe/0x130 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0xd1/0x650 mm/kasan/report.c:482 kasan_report+0xfb/0x140 mm/kasan/report.c:595 __asan_report_load1_noabort+0x14/0x30 mm/kasan/report_generic.c:378 fname_full_size fs/ntfs3/ntfs.h:590 [inline] cmp_fnames+0x1ea/0x230 fs/ntfs3/index.c:46 hdr_find_e.isra.0+0x3ed/0x670 fs/ntfs3/index.c:762 indx_find+0x4b5/0x900 fs/ntfs3/index.c:1186 dir_search_u+0x2c0/0x460 fs/ntfs3/dir.c:254 ntfs_lookup+0x1cc/0x2a0 fs/ntfs3/namei.c:85 __lookup_slow+0x241/0x450 fs/namei.c:1816 lookup_slow fs/namei.c:1833 [inline] walk_component+0x31c/0x570 fs/namei.c:2151 link_path_walk+0x592/0xd60 fs/namei.c:2519 path_lookupat+0x138/0x660 fs/namei.c:2675 filename_lookup+0x1f3/0x560 fs/namei.c:2705 filename_setxattr+0xad/0x1c0 fs/xattr.c:660 path_setxattrat+0x1d8/0x280 fs/xattr.c:713 __do_sys_lsetxattr fs/xattr.c:754 [inline] __se_sys_lsetxattr fs/xattr.c:750 [inline] __x64_sys_lsetxattr+0xd0/0x150 fs/xattr.c:750 ... Allocated by task 9279: kasan_save_stack+0x39/0x70 mm/kasan/common.c:56 kasan_save_track+0x14/0x40 mm/kasan/common.c:77 kasan_save_alloc_info+0x37/0x60 mm/kasan/generic.c:573 poison_kmalloc_redzone mm/kasan/common.c:400 [inline] __kasan_kmalloc+0xc3/0xd0 mm/kasan/common.c:417 kasan_kmalloc include/linux/kasan.h:262 [inline] __do_kmalloc_node mm/slub.c:5650 [inline] __kmalloc_noprof+0x2bd/0x900 mm/slub.c:5662 kmalloc_noprof include/linux/slab.h:961 [inline] indx_read+0x41d/0xad0 fs/ntfs3/index.c:1059 indx_find+0x447/0x900 fs/ntfs3/index.c:1179 dir_search_u+0x2c0/0x460 fs/ntfs3/dir.c:254 ntfs_lookup+0x1cc/0x2a0 fs/ntfs3/namei.c:85 __lookup_slow+0x241/0x450 fs/namei.c:1816 lookup_slow fs/namei.c:1833 [inline] walk_component+0x31c/0x570 fs/namei.c:2151 link_path_walk+0x592/0xd60 fs/namei.c:2519 path_lookupat+0x138/0x660 fs/namei.c:2675 filename_lookup+0x1f3/0x560 fs/namei.c:2705 filename_setxattr+0xad/0x1c0 fs/xattr.c:660 path_setxattrat+0x1d8/0x280 fs/xattr.c:713 __do_sys_lsetxattr fs/xattr.c:754 [inline] __se_sys_lsetxattr fs/xattr.c:750 [inline] __x64_sys_lsetxattr+0xd0/0x150 fs/xattr.c:750 ... [CAUSE] The index-header validators only validated INDEX_HDR-level geometry. They did not walk each NTFS_DE to verify entry alignment, subnode layout, or that key_size fit inside the entry payload. They also allowed a last sentinel entry to carry a non-zero key_size. [FIX] Walk every NTFS_DE in ntfs3's index-header validators and reject entries with invalid layout, mismatched subnode state, oversized key_size, or non-zero sentinel keys before lookup or log replay can consume them.
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/0257e3ea00e19129f3ad5c039d8b8fdff0796835
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/98d6e5d9dc1d34dcffc61549617581a5fe1ef807
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/a8f4fb6a7d58974ffc9aed597401528b181d76dc
Impacted products
Vendor Product Version
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/ntfs3/fslog.c",
            "fs/ntfs3/index.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "a8f4fb6a7d58974ffc9aed597401528b181d76dc",
              "status": "affected",
              "version": "82cae269cfa953032fbb8980a7d554d60fb00b17",
              "versionType": "git"
            },
            {
              "lessThan": "0257e3ea00e19129f3ad5c039d8b8fdff0796835",
              "status": "affected",
              "version": "82cae269cfa953032fbb8980a7d554d60fb00b17",
              "versionType": "git"
            },
            {
              "lessThan": "98d6e5d9dc1d34dcffc61549617581a5fe1ef807",
              "status": "affected",
              "version": "82cae269cfa953032fbb8980a7d554d60fb00b17",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/ntfs3/fslog.c",
            "fs/ntfs3/index.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.15"
            },
            {
              "lessThan": "5.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.111",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.53",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs/ntfs3: validate index entry key bounds\n\n[BUG]\nA malformed NTFS directory index entry can advertise a key_size larger\nthan the bytes actually present in its NTFS_DE payload. Directory lookup\nthen passes that malformed key to cmp_fnames(), which can read past the\nend of the kmalloc\u0027ed index buffer.\n\nBUG: KASAN: slab-out-of-bounds in fname_full_size fs/ntfs3/ntfs.h:590 [inline]\nBUG: KASAN: slab-out-of-bounds in cmp_fnames+0x1ea/0x230 fs/ntfs3/index.c:46\nRead of size 1 at addr ffff88801c313018 by task syz.6.3365/9279\n\nCall Trace:\n __dump_stack lib/dump_stack.c:94 [inline]\n dump_stack_lvl+0xbe/0x130 lib/dump_stack.c:120\n print_address_description mm/kasan/report.c:378 [inline]\n print_report+0xd1/0x650 mm/kasan/report.c:482\n kasan_report+0xfb/0x140 mm/kasan/report.c:595\n __asan_report_load1_noabort+0x14/0x30 mm/kasan/report_generic.c:378\n fname_full_size fs/ntfs3/ntfs.h:590 [inline]\n cmp_fnames+0x1ea/0x230 fs/ntfs3/index.c:46\n hdr_find_e.isra.0+0x3ed/0x670 fs/ntfs3/index.c:762\n indx_find+0x4b5/0x900 fs/ntfs3/index.c:1186\n dir_search_u+0x2c0/0x460 fs/ntfs3/dir.c:254\n ntfs_lookup+0x1cc/0x2a0 fs/ntfs3/namei.c:85\n __lookup_slow+0x241/0x450 fs/namei.c:1816\n lookup_slow fs/namei.c:1833 [inline]\n walk_component+0x31c/0x570 fs/namei.c:2151\n link_path_walk+0x592/0xd60 fs/namei.c:2519\n path_lookupat+0x138/0x660 fs/namei.c:2675\n filename_lookup+0x1f3/0x560 fs/namei.c:2705\n filename_setxattr+0xad/0x1c0 fs/xattr.c:660\n path_setxattrat+0x1d8/0x280 fs/xattr.c:713\n __do_sys_lsetxattr fs/xattr.c:754 [inline]\n __se_sys_lsetxattr fs/xattr.c:750 [inline]\n __x64_sys_lsetxattr+0xd0/0x150 fs/xattr.c:750\n ...\n\nAllocated by task 9279:\n kasan_save_stack+0x39/0x70 mm/kasan/common.c:56\n kasan_save_track+0x14/0x40 mm/kasan/common.c:77\n kasan_save_alloc_info+0x37/0x60 mm/kasan/generic.c:573\n poison_kmalloc_redzone mm/kasan/common.c:400 [inline]\n __kasan_kmalloc+0xc3/0xd0 mm/kasan/common.c:417\n kasan_kmalloc include/linux/kasan.h:262 [inline]\n __do_kmalloc_node mm/slub.c:5650 [inline]\n __kmalloc_noprof+0x2bd/0x900 mm/slub.c:5662\n kmalloc_noprof include/linux/slab.h:961 [inline]\n indx_read+0x41d/0xad0 fs/ntfs3/index.c:1059\n indx_find+0x447/0x900 fs/ntfs3/index.c:1179\n dir_search_u+0x2c0/0x460 fs/ntfs3/dir.c:254\n ntfs_lookup+0x1cc/0x2a0 fs/ntfs3/namei.c:85\n __lookup_slow+0x241/0x450 fs/namei.c:1816\n lookup_slow fs/namei.c:1833 [inline]\n walk_component+0x31c/0x570 fs/namei.c:2151\n link_path_walk+0x592/0xd60 fs/namei.c:2519\n path_lookupat+0x138/0x660 fs/namei.c:2675\n filename_lookup+0x1f3/0x560 fs/namei.c:2705\n filename_setxattr+0xad/0x1c0 fs/xattr.c:660\n path_setxattrat+0x1d8/0x280 fs/xattr.c:713\n __do_sys_lsetxattr fs/xattr.c:754 [inline]\n __se_sys_lsetxattr fs/xattr.c:750 [inline]\n __x64_sys_lsetxattr+0xd0/0x150 fs/xattr.c:750\n ...\n\n[CAUSE]\nThe index-header validators only validated INDEX_HDR-level geometry.\nThey did not walk each NTFS_DE to verify entry alignment, subnode\nlayout, or that key_size fit inside the entry payload. They also\nallowed a last sentinel entry to carry a non-zero key_size.\n\n[FIX]\nWalk every NTFS_DE in ntfs3\u0027s index-header validators and reject\nentries with invalid layout, mismatched subnode state, oversized\nkey_size, or non-zero sentinel keys before lookup or log replay can\nconsume them."
    }
  ],
  "id": "CVE-2026-97438",
  "lastModified": "2026-09-25T13:17:27.430",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 7.1,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 5.2,
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-09-24T17:17:21.930",
  "references": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/0257e3ea00e19129f3ad5c039d8b8fdff0796835"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/98d6e5d9dc1d34dcffc61549617581a5fe1ef807"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/a8f4fb6a7d58974ffc9aed597401528b181d76dc"
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "vulnStatus": "Received"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.