CVE-2026-72191

Name of the Vulnerable Software and Affected Versions Linux kernel version 7.0.0-rc7

Description An issue exists in the ntfs3 driver where the indx insert into buffer() function fails to properly validate the split-point offset. The hdr find split() function iterates through entries using the e->size field without verifying that the step remains within the hdr->used boundary or that the size is at least the size of a NTFS DE structure. An attacker can use a crafted NTFS image with a specifically sized NTFS DE to cause a u32 subtraction underflow. This results in a memmove() operation with a massive count (nearly 4 GiB), leading to an out-of-bounds kernel write that corrupts memory and causes a kernel panic. This can be triggered by mounting a malicious filesystem image via USB, loopback, or removable media.

Recommendations For Linux kernel version 7.0.0-rc7, update the kernel to a version where the split is rejected whenever the chosen sp plus its declared size extends past hdr1->used.