CVE-2026-53023
kernel: fs/ntfs3: terminate the cached volume label after UTF-8 conversion
Loading…
Severity
UnknownRed Hat Product Security
CVSS
Review impact separately from score.
Published · June 24, 2026
Updated · June 27, 2026
Description
A flaw was found in the Linux kernel's NTFS3 file system driver. The ntfs_fill_super() function, responsible for loading the volume label, did not properly null-terminate the converted UTF-8 label. This oversight could allow the ntfs3_label_show() function to read beyond the allocated buffer when displaying the volume label, potentially leading to information disclosure.
Mitigation
No mitigation is specified in collected source.
CVSS / CWE
CWE-170 · Improper Null Termination