{"schema":"threatline.record/2","record":{"id":"CVE-2026-97437","aliases":[],"summary":"ntfs3: fix out-of-bounds read in ntfs_dir_emit() and hdr_find_e()","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nntfs3: fix out-of-bounds read in ntfs_dir_emit() and hdr_find_e()\n\nThe bounds check in ntfs_dir_emit() compares fname->name_len (a\ncharacter count) against e->size (a byte count) without accounting\nfor the 2-byte-per-character UTF-16LE encoding or the ATTR_FILE_NAME\nheader size:\n\n  if (fname->name_len + sizeof(struct NTFS_DE) > le16_to_cpu(e->size))\n\nThis computes: name_len + 16 > e_size\n\nThe correct check must account for the ATTR_FILE_NAME header (66 bytes\nbefore the name) and the UTF-16LE character size (2 bytes each):\n\n  sizeof(NTFS_DE) + offsetof(ATTR_FILE_NAME, name) +\n  name_len * sizeof(short) > e_size\n\nWhich computes: 16 + 66 + name_len * 2 > e_size\n\nThe correct calculation already exists as fname_full_size() in ntfs.h\nand is used in cmp_fnames(), namei.c, and fslog.c, but was not used\nin the readdir path.\n\nA crafted NTFS image with an index entry containing a small e->size\nbut large fname->name_len bypasses the current check, causing\nntfs_utf16_to_nls() to read past the entry boundary.\n\nAdditionally, add a key_size validation in hdr_find_e() to ensure the\ndeclared key_size does not exceed the available entry data, preventing\ncomparison functions from reading past entry boundaries on the lookup\npath.","categories":["Operating systems"],"product":"Linux","vendor":"Linux","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-97437","source_modified_at":"2026-10-03T10:58:22.091Z","fetched_at":"2026-10-23T18:52:38.922436Z","product":"Linux","vendor":"Linux","versions":[{"version":"4342306f0f0d5ff4315a204d315c1b51b914fca5","lessThan":"d1f98938e437732c0ecdfc8ee451e12a072f6d07","status":"affected","versionType":"git"},{"version":"4342306f0f0d5ff4315a204d315c1b51b914fca5","lessThan":"0505f1e7bb5b981b6ed62d98b26ddce76142865d","status":"affected","versionType":"git"},{"version":"4342306f0f0d5ff4315a204d315c1b51b914fca5","lessThan":"2f7d0ec8c10dc7bf7a8c9a9cb169f9a4d1fac2ba","status":"affected","versionType":"git"},{"version":"4342306f0f0d5ff4315a204d315c1b51b914fca5","lessThan":"ed6da1abeec50db9060d714f03743fe0b63e4fe4","status":"affected","versionType":"git"},{"version":"4342306f0f0d5ff4315a204d315c1b51b914fca5","lessThan":"6a8149a20e46086c756c2a9202e377c0b649a0c3","status":"affected","versionType":"git"},{"version":"4342306f0f0d5ff4315a204d315c1b51b914fca5","lessThan":"aa1bdbb39f49c5bc9779316891c40005517842a5","status":"affected","versionType":"git"}],"defaultStatus":"unaffected"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-97437","source_modified_at":"2026-10-03T10:58:22.091Z","fetched_at":"2026-10-23T18:52:38.922436Z","product":"Linux","vendor":"Linux","versions":[{"version":"5.15","status":"affected"},{"version":"0","lessThan":"5.15","status":"unaffected","versionType":"semver"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","status":"unaffected","versionType":"semver"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","status":"unaffected","versionType":"semver"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","status":"unaffected","versionType":"semver"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","status":"unaffected","versionType":"semver"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","status":"unaffected","versionType":"semver"},{"version":"7.2","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}],"defaultStatus":"affected"}],"fixed_versions":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-97437","source_modified_at":"2026-10-03T10:58:22.091Z","fetched_at":"2026-10-23T18:52:38.922436Z","package":{"name":"Linux","ecosystem":null},"version":"0505f1e7bb5b981b6ed62d98b26ddce76142865d","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-97437","source_modified_at":"2026-10-03T10:58:22.091Z","fetched_at":"2026-10-23T18:52:38.922436Z","package":{"name":"Linux","ecosystem":null},"version":"2f7d0ec8c10dc7bf7a8c9a9cb169f9a4d1fac2ba","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-97437","source_modified_at":"2026-10-03T10:58:22.091Z","fetched_at":"2026-10-23T18:52:38.922436Z","package":{"name":"Linux","ecosystem":null},"version":"6a8149a20e46086c756c2a9202e377c0b649a0c3","basis":"first unaffected version stated in the CVE record"}],"cvss":7.1,"severity":"High","kev":{"listed":false},"epss":{"probability":0.00138,"percentile":0.0288,"score_date":"2026-10-23"},"published_at":"2026-09-24T16:03:50.105Z","modified_at":"2026-10-03T10:58:22.091Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-97437","fetched_at":"2026-10-23T18:52:38.922436Z","source_modified_at":"2026-10-03T10:58:22.091Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-97437","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CVE List","EPSS"],"references":[{"source":"CVE List","url":"https://git.kernel.org/stable/c/d1f98938e437732c0ecdfc8ee451e12a072f6d07"},{"source":"CVE List","url":"https://git.kernel.org/stable/c/0505f1e7bb5b981b6ed62d98b26ddce76142865d"},{"source":"CVE List","url":"https://git.kernel.org/stable/c/2f7d0ec8c10dc7bf7a8c9a9cb169f9a4d1fac2ba"},{"source":"CVE List","url":"https://git.kernel.org/stable/c/ed6da1abeec50db9060d714f03743fe0b63e4fe4"},{"source":"CVE List","url":"https://git.kernel.org/stable/c/6a8149a20e46086c756c2a9202e377c0b649a0c3"},{"source":"CVE List","url":"https://git.kernel.org/stable/c/aa1bdbb39f49c5bc9779316891c40005517842a5"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"product","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-10-03T10:58:22.091Z","content_hash":"153fb0d6c53d235bfd9013d84006f03d223316aeafc70d4c9f2fbd4e3734b525"}}