{ "schema_version": "1.6.1", "id": "RPI-CVE-2026-72478", "modified": "2026-10-09T11:39:44Z", "upstream": [ "CVE-2026-72478" ], "published": "2026-08-15T06:04:33Z", "summary": "fs/ntfs3: add bounds check to run_get_highest_vcn()", "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs/ntfs3: add bounds check to run_get_highest_vcn()\n\nrun_get_highest_vcn() parses a packed NTFS mapping-pairs buffer without\nany length bound, relying solely on a 0x00 terminator to stop. A\ncrafted $LogFile UpdateMappingPairs record whose embedded attribute\ncontains mapping-pairs runs without a terminator causes the function to\nread past the slab allocation, triggering a KASAN slab-out-of-bounds\nread on mount.\n\nThe sibling function run_unpack() received an analogous bounds-check in\ncommit b62567bca474 (\"ntfs3: add buffer boundary checks to run_unpack()\"),\nbut run_get_highest_vcn() was missed.\n\nTake a run_buf_size parameter and reject any run header whose payload\nwould extend past the buffer end, mirroring the pattern used by\nrun_unpack(). The caller in fslog.c passes the remaining attribute\nbytes after the mapping-pairs offset.\n\nKASAN report (on mainline v7.1 merge window HEAD):\n\n BUG: KASAN: slab-out-of-bounds in run_get_highest_vcn+0x3c0/0x410\n Read of size 1 at addr ffff88800e2d5400 by task mount/72\n Call Trace:\n run_get_highest_vcn+0x3c0/0x410\n do_action.isra.0+0x3ba8/0x7b50\n log_replay+0x9ddd/0x10200\n ntfs_loadlog_and_replay+0x4ad/0x610\n ntfs_fill_super+0x214a/0x4540", "severity": [ { "type": "CVSS_V3", "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "affected": [ { "package": { "ecosystem": "Raspberry Pi OS:12", "name": "linux" }, "versions": [ "1:6.12.87-1+rpt1~bookworm", "1:6.12.93-1+rpt1", "1:6.12.96-1+rpt1" ], "ecosystem_specific": { "binaries": [ { "binary_name": "linux-image-6.12.87+rpt-rpi-2712", "binary_version": "1:6.12.87-1+rpt1~bookworm" }, { "binary_name": "linux-image-6.12.87+rpt-rpi-v6", "binary_version": "1:6.12.87-1+rpt1~bookworm" }, { "binary_name": "linux-image-6.12.87+rpt-rpi-v7", "binary_version": "1:6.12.87-1+rpt1~bookworm" }, { "binary_name": "linux-image-6.12.87+rpt-rpi-v7l", "binary_version": "1:6.12.87-1+rpt1~bookworm" }, { "binary_name": "linux-image-6.12.87+rpt-rpi-v8", "binary_version": "1:6.12.87-1+rpt1~bookworm" }, { "binary_name": "linux-image-6.12.87+rpt-rpi-v8-rt", "binary_version": "1:6.12.87-1+rpt1~bookworm" }, { "binary_name": "linux-image-6.12.93+rpt-rpi-2712", "binary_version": "1:6.12.93-1+rpt1" }, { "binary_name": "linux-image-6.12.93+rpt-rpi-v6", "binary_version": "1:6.12.93-1+rpt1" }, { "binary_name": "linux-image-6.12.93+rpt-rpi-v7", "binary_version": "1:6.12.93-1+rpt1" }, { "binary_name": "linux-image-6.12.93+rpt-rpi-v7l", "binary_version": "1:6.12.93-1+rpt1" }, { "binary_name": "linux-image-6.12.93+rpt-rpi-v8", "binary_version": "1:6.12.93-1+rpt1" }, { "binary_name": "linux-image-6.12.93+rpt-rpi-v8-rt", "binary_version": "1:6.12.93-1+rpt1" }, { "binary_name": "linux-image-6.12.96+rpt-rpi-2712", "binary_version": "1:6.12.96-1+rpt1" }, { "binary_name": "linux-image-6.12.96+rpt-rpi-v6", "binary_version": "1:6.12.96-1+rpt1" }, { "binary_name": "linux-image-6.12.96+rpt-rpi-v7", "binary_version": "1:6.12.96-1+rpt1" }, { "binary_name": "linux-image-6.12.96+rpt-rpi-v7l", "binary_version": "1:6.12.96-1+rpt1" }, { "binary_name": "linux-image-6.12.96+rpt-rpi-v8", "binary_version": "1:6.12.96-1+rpt1" }, { "binary_name": "linux-image-6.12.96+rpt-rpi-v8-rt", "binary_version": "1:6.12.96-1+rpt1" } ] }, "database_specific": { "per_version": { "1:6.12.87-1+rpt1~bookworm": { "linux_commit": "ae4d75fb36deba0fe1a986d9bfae65755e082dd0", "upstream_version": "6.12.87", "assessment": "commit ancestry (strak rule)", "upstream_fixed": "6.12.97" }, "1:6.12.93-1+rpt1": { "linux_commit": "d8ab4e908235da7727f22dd36ad5af224671677d", "upstream_version": "6.12.93", "assessment": "commit ancestry (strak rule)", "upstream_fixed": "6.12.97" }, "1:6.12.96-1+rpt1": { "linux_commit": "ae161617d7a4552fa91d03626b8d9f3696d17481", "upstream_version": "6.12.96", "assessment": "commit ancestry (strak rule)", "upstream_fixed": "6.12.97" } } } }, { "package": { "ecosystem": "Raspberry Pi OS:13", "name": "linux" }, "versions": [ "1:6.18.29-1+rpt1", "1:6.18.33-1+rpt1", "1:6.18.34-1+rpt1", "1:6.18.39-1+rpt1" ], "ecosystem_specific": { "binaries": [ { "binary_name": "linux-image-6.18.29+rpt-rpi-2712", "binary_version": "1:6.18.29-1+rpt1" }, { "binary_name": "linux-image-6.18.29+rpt-rpi-v6", "binary_version": "1:6.18.29-1+rpt1" }, { "binary_name": "linux-image-6.18.29+rpt-rpi-v7", "binary_version": "1:6.18.29-1+rpt1" }, { "binary_name": "linux-image-6.18.29+rpt-rpi-v8", "binary_version": "1:6.18.29-1+rpt1" }, { "binary_name": "linux-image-6.18.29+rpt-rpi-v8-rt", "binary_version": "1:6.18.29-1+rpt1" }, { "binary_name": "linux-image-6.18.33+rpt-rpi-2712", "binary_version": "1:6.18.33-1+rpt1" }, { "binary_name": "linux-image-6.18.33+rpt-rpi-v6", "binary_version": "1:6.18.33-1+rpt1" }, { "binary_name": "linux-image-6.18.33+rpt-rpi-v7", "binary_version": "1:6.18.33-1+rpt1" }, { "binary_name": "linux-image-6.18.33+rpt-rpi-v8", "binary_version": "1:6.18.33-1+rpt1" }, { "binary_name": "linux-image-6.18.33+rpt-rpi-v8-rt", "binary_version": "1:6.18.33-1+rpt1" }, { "binary_name": "linux-image-6.18.34+rpt-rpi-2712", "binary_version": "1:6.18.34-1+rpt1" }, { "binary_name": "linux-image-6.18.34+rpt-rpi-v6", "binary_version": "1:6.18.34-1+rpt1" }, { "binary_name": "linux-image-6.18.34+rpt-rpi-v7", "binary_version": "1:6.18.34-1+rpt1" }, { "binary_name": "linux-image-6.18.34+rpt-rpi-v8", "binary_version": "1:6.18.34-1+rpt1" }, { "binary_name": "linux-image-6.18.34+rpt-rpi-v8-rt", "binary_version": "1:6.18.34-1+rpt1" }, { "binary_name": "linux-image-6.18.39+rpt-rpi-2712", "binary_version": "1:6.18.39-1+rpt1" }, { "binary_name": "linux-image-6.18.39+rpt-rpi-v6", "binary_version": "1:6.18.39-1+rpt1" }, { "binary_name": "linux-image-6.18.39+rpt-rpi-v7", "binary_version": "1:6.18.39-1+rpt1" }, { "binary_name": "linux-image-6.18.39+rpt-rpi-v8", "binary_version": "1:6.18.39-1+rpt1" }, { "binary_name": "linux-image-6.18.39+rpt-rpi-v8-rt", "binary_version": "1:6.18.39-1+rpt1" } ] }, "database_specific": { "per_version": { "1:6.18.29-1+rpt1": { "linux_commit": "66318c5b5cd8145a662303af12ed39ac07eb27cc", "upstream_version": "6.18.29", "assessment": "commit ancestry (strak rule)", "upstream_fixed": "6.18.40" }, "1:6.18.33-1+rpt1": { "linux_commit": "95b85bebbedcaedfa7ca79116ed38b7376fba412", "upstream_version": "6.18.33", "assessment": "commit ancestry (strak rule)", "upstream_fixed": "6.18.40" }, "1:6.18.34-1+rpt1": { "linux_commit": "c8c7494100e99ee05b11aaa4f0588a223a63d1af", "upstream_version": "6.18.34", "assessment": "commit ancestry (strak rule)", "upstream_fixed": "6.18.40" }, "1:6.18.39-1+rpt1": { "linux_commit": "60ea684a8ace97bb0db1a16e20753bdd6ab371ff", "upstream_version": "6.18.39", "assessment": "commit ancestry (strak rule)", "upstream_fixed": "6.18.40" } } } } ], "references": [ { "type": "ADVISORY", "url": "https://www.cve.org/CVERecord?id=CVE-2026-72478" }, { "type": "FIX", "url": "https://git.kernel.org/stable/c/c69b9003332917b652175d5fa9d84158c5ed8617" }, { "type": "FIX", "url": "https://git.kernel.org/stable/c/8afc24a884aff6a6f08028bd779ee65c40054455" }, { "type": "FIX", "url": "https://git.kernel.org/stable/c/c23083b472a720c3f60b147db05b25b751c7c1bf" }, { "type": "FIX", "url": "https://git.kernel.org/stable/c/a31893206588374d7d16fad387189d8165c7efd3" }, { "type": "FIX", "url": "https://git.kernel.org/stable/c/41081202eb823f5b27ff164b12010b24428100ad" }, { "type": "FIX", "url": "https://git.kernel.org/stable/c/bb11485a87fbb2254b62cfed630b699d50e57da8" } ], "database_specific": { "source": "https://git.kernel.org/pub/scm/linux/security/vulns.git", "upstream_modified": "2026-08-17T05:50:24Z", "severity": { "source": "kernel CNA", "cvss_v3_score": 8.4, "cvss_v3_severity": "High", "scenario": "AV:L - mount(2)/get_tree_bdev on a crafted NTFS block device or loop image reaches ntfs_fill_super()\u2192ntfs_loadlog_and_replay()\u2192log_replay()\u2192do_action(UpdateMappingPairs)\u2192run_get_highest_vcn(); no network handler parses $LogFile.\nAC:L - The attacker fully controls the on-disk $LogFile UpdateMappingPairs record and embedded non-resident mapping-pairs bytes; omitting the 0x00 terminator deterministically drives the unbounded parser past the attribute buffer on the first replay mount with no race.\nPR:N - The attacker needs no account or privilege on the victim; supplying a malicious NTFS image on USB/removable media, a disk image, or shared storage is sufficient for udisks2/systemd automount or an administrator mount to reach journal replay.\nUI:N - Desktop/kiosk/shared-workstation automounters mount attacker-supplied NTFS media and run $LogFile replay without the user opening files or running commands; insertion of the crafted volume is sufficient to trigger parsing on mount.\nS:U - Slab out-of-bounds reads and resulting mount-time kernel faults stay within the host kernel security authority; no VM escape, IOMMU bypass, or cross-boundary scope change.\nC:H - run_get_highest_vcn() scans mapping pairs with no length bound, performing slab out-of-bounds byte reads via run_unpack_s64(); kernel guidance treats heap out-of-bounds reads as enabling broad adjacent-slab information disclosure.\nI:H - Parsed run lengths and offsets come from attacker-chosen and out-of-bounds heap bytes and, if the loop terminates, are written into attr->nres.evcn during log replay, corrupting non-resident extent metadata and redirecting later replayed cluster I/O.\nA:H - The demonstrated KASAN slab-out-of-bounds read in the mount task can fault into unmapped adjacent memory, producing a kernel oops/panic and denying service until reboot." } } }