All vulnerabilities
CVE-2026-97437

Linux: ntfs3: fix out-of-bounds read in ntfs_dir_emit() and hdr_find_e()

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
7.1High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.14%Chance of exploitation activity in the next 30 days, higher than 2% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in0505f1e7bb5b981b6ed62d98b26ddce76142865dAlso 2f7d0ec8c10dc7bf7a8c9a9cb169f9a4d1fac2ba, 6a8149a20e46086c756c2a9202e377c0b649a0c3CVE List
Published24 Sep 2026Updated 3 Oct 2026CVE List

What fixes it

  • 0505f1e7bb5b981b6ed62d98b26ddce76142865dLinuxCVE List
  • 2f7d0ec8c10dc7bf7a8c9a9cb169f9a4d1fac2baLinuxCVE List
  • 6a8149a20e46086c756c2a9202e377c0b649a0c3LinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

ntfs3: fix out-of-bounds read in ntfs_dir_emit() and hdr_find_e()

The bounds check in ntfs_dir_emit() compares fname->name_len (a character count) against e->size (a byte count) without accounting for the 2-byte-per-character UTF-16LE encoding or the ATTR_FILE_NAME header size:

if (fname->name_len + sizeof(struct NTFS_DE) > le16_to_cpu(e->size))

This computes: name_len + 16 > e_size

The correct check must account for the ATTR_FILE_NAME header (66 bytes before the name) and the UTF-16LE character size (2 bytes each):

sizeof(NTFS_DE) + offsetof(ATTR_FILE_NAME, name) + name_len * sizeof(short) > e_size

Which computes: 16 + 66 + name_len * 2 > e_size

The correct calculation already exists as fname_full_size() in ntfs.h and is used in cmp_fnames(), namei.c, and fslog.c, but was not used in the readdir path.

A crafted NTFS image with an index entry containing a small e->size but large fname->name_len bypasses the current check, causing ntfs_utf16_to_nls() to read past the entry boundary.

Additionally, add a key_size validation in hdr_find_e() to ensure the declared key_size does not exceed the available entry data, preventing comparison functions from reading past entry boundaries on the lookup path.

Text from CVE List

Affected versions 14

  • Linuxaffected: 4342306f0f0d5ff4315a204d315c1b51b914fca5 before d1f98938e437732c0ecdfc8ee451e12a072f6d07CVE List
  • Linuxaffected: 4342306f0f0d5ff4315a204d315c1b51b914fca5 before 0505f1e7bb5b981b6ed62d98b26ddce76142865dCVE List
  • Linuxaffected: 4342306f0f0d5ff4315a204d315c1b51b914fca5 before 2f7d0ec8c10dc7bf7a8c9a9cb169f9a4d1fac2baCVE List
  • Linuxaffected: 4342306f0f0d5ff4315a204d315c1b51b914fca5 before ed6da1abeec50db9060d714f03743fe0b63e4fe4CVE List
  • Linuxaffected: 4342306f0f0d5ff4315a204d315c1b51b914fca5 before 6a8149a20e46086c756c2a9202e377c0b649a0c3CVE List
  • Linuxaffected: 4342306f0f0d5ff4315a204d315c1b51b914fca5 before aa1bdbb39f49c5bc9779316891c40005517842a5CVE List
  • Linuxaffected: 5.15CVE List
  • Linuxunaffected: all versions before 5.15CVE List
  • Linuxunaffected: 5.15.222 through 5.15.*CVE List
  • Linuxunaffected: 6.1.189 through 6.1.*CVE List
  • Linuxunaffected: 6.6.158 through 6.6.*CVE List
  • Linuxunaffected: 6.12.111 through 6.12.*CVE List
  • Linuxunaffected: 6.18.53 through 6.18.*CVE List
  • Linuxunaffected: 7.2CVE List

References 6