CVE-2026-97437 (GCVE-0-2026-97437)
Vulnerability from cvelistv5
Published
2026-09-24 16:03
Modified
2026-10-03 10:58
Severity ?
7.1 (High) - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: ntfs3: fix out-of-bounds read in ntfs_dir_emit() and hdr_find_e() The bounds check in ntfs_dir_emit() compares fname->name_len (a character count) against e->size (a byte count) without accounting for the 2-byte-per-character UTF-16LE encoding or the ATTR_FILE_NAME header size: if (fname->name_len + sizeof(struct NTFS_DE) > le16_to_cpu(e->size)) This computes: name_len + 16 > e_size The correct check must account for the ATTR_FILE_NAME header (66 bytes before the name) and the UTF-16LE character size (2 bytes each): sizeof(NTFS_DE) + offsetof(ATTR_FILE_NAME, name) + name_len * sizeof(short) > e_size Which computes: 16 + 66 + name_len * 2 > e_size The correct calculation already exists as fname_full_size() in ntfs.h and is used in cmp_fnames(), namei.c, and fslog.c, but was not used in the readdir path. A crafted NTFS image with an index entry containing a small e->size but large fname->name_len bypasses the current check, causing ntfs_utf16_to_nls() to read past the entry boundary. Additionally, add a key_size validation in hdr_find_e() to ensure the declared key_size does not exceed the available entry data, preventing comparison functions from reading past entry boundaries on the lookup path.
References
Impacted products
Vendor Product Version
Linux Linux Version: 4342306f0f0d5ff4315a204d315c1b51b914fca5
Version: 4342306f0f0d5ff4315a204d315c1b51b914fca5
Version: 4342306f0f0d5ff4315a204d315c1b51b914fca5
Version: 4342306f0f0d5ff4315a204d315c1b51b914fca5
Version: 4342306f0f0d5ff4315a204d315c1b51b914fca5
Version: 4342306f0f0d5ff4315a204d315c1b51b914fca5
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/ntfs3/dir.c",
            "fs/ntfs3/index.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "d1f98938e437732c0ecdfc8ee451e12a072f6d07",
              "status": "affected",
              "version": "4342306f0f0d5ff4315a204d315c1b51b914fca5",
              "versionType": "git"
            },
            {
              "lessThan": "0505f1e7bb5b981b6ed62d98b26ddce76142865d",
              "status": "affected",
              "version": "4342306f0f0d5ff4315a204d315c1b51b914fca5",
              "versionType": "git"
            },
            {
              "lessThan": "2f7d0ec8c10dc7bf7a8c9a9cb169f9a4d1fac2ba",
              "status": "affected",
              "version": "4342306f0f0d5ff4315a204d315c1b51b914fca5",
              "versionType": "git"
            },
            {
              "lessThan": "ed6da1abeec50db9060d714f03743fe0b63e4fe4",
              "status": "affected",
              "version": "4342306f0f0d5ff4315a204d315c1b51b914fca5",
              "versionType": "git"
            },
            {
              "lessThan": "6a8149a20e46086c756c2a9202e377c0b649a0c3",
              "status": "affected",
              "version": "4342306f0f0d5ff4315a204d315c1b51b914fca5",
              "versionType": "git"
            },
            {
              "lessThan": "aa1bdbb39f49c5bc9779316891c40005517842a5",
              "status": "affected",
              "version": "4342306f0f0d5ff4315a204d315c1b51b914fca5",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/ntfs3/dir.c",
            "fs/ntfs3/index.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.15"
            },
            {
              "lessThan": "5.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.222",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.189",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.158",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.111",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.53",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.222",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.189",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.158",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.111",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.53",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nntfs3: fix out-of-bounds read in ntfs_dir_emit() and hdr_find_e()\n\nThe bounds check in ntfs_dir_emit() compares fname-\u003ename_len (a\ncharacter count) against e-\u003esize (a byte count) without accounting\nfor the 2-byte-per-character UTF-16LE encoding or the ATTR_FILE_NAME\nheader size:\n\n  if (fname-\u003ename_len + sizeof(struct NTFS_DE) \u003e le16_to_cpu(e-\u003esize))\n\nThis computes: name_len + 16 \u003e e_size\n\nThe correct check must account for the ATTR_FILE_NAME header (66 bytes\nbefore the name) and the UTF-16LE character size (2 bytes each):\n\n  sizeof(NTFS_DE) + offsetof(ATTR_FILE_NAME, name) +\n  name_len * sizeof(short) \u003e e_size\n\nWhich computes: 16 + 66 + name_len * 2 \u003e e_size\n\nThe correct calculation already exists as fname_full_size() in ntfs.h\nand is used in cmp_fnames(), namei.c, and fslog.c, but was not used\nin the readdir path.\n\nA crafted NTFS image with an index entry containing a small e-\u003esize\nbut large fname-\u003ename_len bypasses the current check, causing\nntfs_utf16_to_nls() to read past the entry boundary.\n\nAdditionally, add a key_size validation in hdr_find_e() to ensure the\ndeclared key_size does not exceed the available entry data, preventing\ncomparison functions from reading past entry boundaries on the lookup\npath."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The attacker-controlled bytes are on-disk NTFS_DE.size, ATTR_FILE_NAME.name_len and NTFS_DE.key_size. getdents64\u2192iterate_dir\u2192ntfs_readdir\u2192ntfs_read_hdr\u2192ntfs_dir_emit() and ntfs_lookup/ntfs_fill_super\u2192ntfs_extend_init\u2192dir_search_u\u2192indx_find\u2192hdr_find_e() consume those fields; no SMB, NFS, or TCP message carries them.\nAC:L - A crafted index entry with e-\u003esize \u003e= name_len+sizeof(NTFS_DE) but smaller than sizeof(NTFS_DE)+offsetof(ATTR_FILE_NAME,name)+name_len*2 bypasses the old ntfs_dir_emit() check so ntfs_utf16_to_nls() over-reads on every readdir of that directory; the same image can set key_size \u003e e-\u003esize-sizeof(NTFS_DE) so hdr_find_e() passes an oversized key to cmp_fnames(). No race.\nPR:N - Crafting the NTFS image needs no host account. ntfs_fs_type.fs_flags is only FS_REQUIRES_DEV|FS_ALLOW_IDMAP (no FS_USERNS_MOUNT), so mount_capable() requires init-namespace CAP_SYS_ADMIN; that mount is scored as UI:R, not attacker privilege. ntfs_dir_emit() and hdr_find_e() have no capable() gate after the volume is mounted.\nUI:R - The bad name_len and key_size are inert on-disk until a victim or automount helper mounts the image via path_mount\u2192get_tree_bdev\u2192ntfs_fill_super. That mount is the required user action; ntfs_extend_init() even calls dir_search_u()\u2192hdr_find_e() during fill_super, and a subsequent getdents reaches ntfs_dir_emit().\nS:U - The over-read in ntfs_utf16_to_nls()/cmp_fnames() and any oops stay in the host kernel that mounted the volume. This is not a KVM/Xen guest-to-host escape or an IOMMU/DMA boundary bypass.\nC:H - ntfs_dir_emit() hands attacker-chosen fname-\u003ename_len (u8, up to 255 UTF-16 units) to ntfs_utf16_to_nls() after a check that ignores the 66-byte ATTR_FILE_NAME header and 2-byte encoding, so up to ~321 bytes past the NTFS_DE\u2014and past indx_read()\u0027s kmalloc(1\u003c\u003cindex_bits) if the entry is at the buffer tail\u2014are converted and dir_emit()\u0027d into getdents. hdr_find_e() likewise lets cmp_fnames() read past that slab.\nI:N - ntfs_utf16_to_nls() writes only into the PATH_MAX buffer kmalloc\u0027d by ntfs_readdir(); dir_emit()/filldir() then copy that name to the user dirent. hdr_find_e\u0027s cmp_fnames() returns only a comparison integer. Neither path is an out-of-bounds write, UAF, or control-flow hijack.\nA:H - indx_read() kmallocs 1\u003c\u003cindex_bits (typically 4K) for the INDEX_BUFFER. An entry near the end with name_len=255, or key_size larger than the remaining payload, makes ntfs_utf16_to_nls() or fname_full_size() in cmp_fnames() read off that object, which can fault unmapped adjacent pages and oops the kernel."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-03T10:58:22.091Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/d1f98938e437732c0ecdfc8ee451e12a072f6d07"
        },
        {
          "url": "https://git.kernel.org/stable/c/0505f1e7bb5b981b6ed62d98b26ddce76142865d"
        },
        {
          "url": "https://git.kernel.org/stable/c/2f7d0ec8c10dc7bf7a8c9a9cb169f9a4d1fac2ba"
        },
        {
          "url": "https://git.kernel.org/stable/c/ed6da1abeec50db9060d714f03743fe0b63e4fe4"
        },
        {
          "url": "https://git.kernel.org/stable/c/6a8149a20e46086c756c2a9202e377c0b649a0c3"
        },
        {
          "url": "https://git.kernel.org/stable/c/aa1bdbb39f49c5bc9779316891c40005517842a5"
        }
      ],
      "title": "ntfs3: fix out-of-bounds read in ntfs_dir_emit() and hdr_find_e()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-97437",
    "datePublished": "2026-09-24T16:03:50.105Z",
    "dateReserved": "2026-09-24T14:53:16.869Z",
    "dateUpdated": "2026-10-03T10:58:22.091Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.