CVE-2026-72195

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An integer underflow exists in the do action() function within the UpdateResidentValue case of the ntfs3 file system. When the sum of lrh->attr off and lrh->redo len is less than attr->res.data off, the calculation of attr->res.data size underflows, potentially resulting in a value of approximately 4 GiB. This allows subsequent code that reads attr->res.data size to read memory up to 4 GiB beyond the 1024-byte MFT (Master File Table) record allocation. While the mi enum attr() function provides some defense by failing the mount during a full attribute walk, read sites that access an attribute by name without re-validating the size remain exposed.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.