CVE-2026-72478

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the run get highest vcn() function within the NTFS3 file system driver. The function parses a packed NTFS mapping-pairs buffer without implementing length bounds, relying exclusively on a 0x00 terminator. A specially crafted $LogFile UpdateMappingPairs record containing mapping-pairs runs without a terminator can cause the function to read beyond the slab allocation during the mount process. This results in a KASAN slab-out-of-bounds read, where KASAN (Kernel Address Sanitizer) is a dynamic memory error detector for the kernel.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.