CVE-2026-72470

A flaw was found in the Linux kernel's NTFS3 file system driver. This vulnerability occurs when a user attempts to mount a specially crafted or dirty NTFS volume where the log page size on disk is larger than the buffer initially allocated by the kernel. This mismatch leads to a buffer overflow, a condition where a program attempts to write data beyond the boundaries of a fixed-length buffer, resulting in memory corruption. A local attacker could exploit this to potentially cause a denial of service (DoS) on the system.

A moderate-impact flaw was found in the Linux kernel's NTFS3 file system driver. During NTFS log replay, log_replay() allocates the log->one_page_buf scratch buffer based on the mounting host's PAGE_SIZE, but when a restart area is found, the log page size recorded on disk is adopted without resizing that buffer. If a dirty NTFS volume records a log page size larger than the buffer initially allocated (for example, a 64K-log volume mounted on a host that allocated a 4K buffer), a subsequent unaligned read_log_page() reads log->page_size bytes into the undersized buffer, overflowing the allocation and causing kernel memory corruption. A local attacker able to mount a specially crafted or dirty NTFS volume could exploit this flaw to crash the system (denial of service). Red Hat Product Security rated this flaw Moderate severity (CVSS 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) because exploiting it requires local access and the privileges needed to mount a file system, and the demonstrated impact is limited to system availability; this differs from the upstream CVE record rating of Important (CVSS 7.8), which additionally assumes high confidentiality and integrity impact. All current Red Hat Enterprise Linux 6, 7, 8, 9, and 10 kernel and kernel-rt update streams, as well as the Red Hat In-Vehicle OS kernel components, have been evaluated as not affected because the vulnerable code is not present in those shipped kernels.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.