CVE-2026-72478

A flaw was found in the Linux kernel's NTFS3 file system driver. The run_get_highest_vcn() function, which processes NTFS mapping-pairs buffers, does not properly validate buffer boundaries. A crafted NTFS log file, when mounted, can cause the system to read beyond its allocated memory. This memory corruption can lead to a system crash, resulting in a denial of service.

This vulnerability is assessed as having a Moderate severity because exploitation requires local system access or administrative privileges to mount an untrusted filesystem, confining the blast radius to an operating system crash. Red Hat Enterprise Linux does not compile or include the NTFS3 driver in its supported kernel builds. Consequently, standard deployments of Red Hat products are not affected by this flaw.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.