CVE-2026-97438

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the ntfs3 driver where a malformed NTFS directory index entry can specify a key size larger than the actual bytes present in its NTFS DE payload. During directory lookup, this malformed key is passed to the cmp fnames() function, which can lead to a slab-out-of-bounds read past the end of the allocated index buffer. This occurs because index-header validators previously only checked INDEX HDR-level geometry and failed to verify individual NTFS DE entry alignment, subnode layout, or whether the key size fit within the entry payload.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.