{
    "dataType": "CVE_RECORD",
    "dataVersion": "5.2",
    "cveMetadata": {
        "cveId": "CVE-2026-72196",
        "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "state": "PUBLISHED",
        "assignerShortName": "Linux",
        "dateReserved": "2026-08-09T03:40:39.911Z",
        "datePublished": "2026-08-15T05:53:55.509Z",
        "dateUpdated": "2026-10-16T18:45:01.462Z"
    },
    "containers": {
        "cna": {
            "providerMetadata": {
                "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
                "shortName": "Linux",
                "dateUpdated": "2026-08-17T05:41:23.012Z"
            },
            "descriptions": [
                {
                    "lang": "en",
                    "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs/ntfs3: bound copy_lcns dp->page_lcns[] index in analysis pass\n\nIn log_replay()'s analysis pass, after find_dp() returns a\nvalid DIR_PAGE_ENTRY for the (target_attr, target_vcn) tuple,\nthe copy_lcns block walks lrh->lcns_follow further entries:\n\n\tt16 = le16_to_cpu(lrh->lcns_follow);\n\tfor (i = 0; i < t16; i++) {\n\t    size_t j = (size_t)(le64_to_cpu(lrh->target_vcn) -\n\t                        le64_to_cpu(dp->vcn));\n\t    dp->page_lcns[j + i] = lrh->page_lcns[i];\n\t}\n\nfind_dp() only validates that target_vcn falls within\n[dp->vcn, dp->vcn + dp->lcns_follow), i.e., that the FIRST\ncluster is covered.  The walk through the further entries is\nnot bounded against dp->lcns_follow.  For a malformed LRH\nwhere target_vcn = dp->vcn + dp->lcns_follow - 1 and\nlrh->lcns_follow > 1, the i > 0 writes overflow the dp's\nallocated page_lcns[] array.\n\nAdd the missing j + lrh->lcns_follow <= dp->lcns_follow guard.\n\nReproduced under UML+KASAN on mainline 8d90b09e6741 as a\nslab-out-of-bounds write of size 8 from log_replay+0x68d4 on\nthe mount path.\n\nThis is distinct from Pavitra Jha's 2026-05-02 patch\n(\"fs/ntfs3: validate lcns_follow in log_replay conversion\",\n<20260502154252.164586-1-jhapavitra98@gmail.com>) which\naddresses the separate version-0 dirty-page-table conversion\npath's memmove(&dp->vcn, ...) call.  The two fixes are\ncomplementary; both should land.\n\n[almaz.alexandrovich@paragon-software.com: clang-formatted the changes,\nfixed conflicts]"
                }
            ],
            "metrics": [
                {
                    "cvssV3_1": {
                        "version": "3.1",
                        "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                        "baseScore": 8.4,
                        "baseSeverity": "HIGH"
                    },
                    "scenarios": [
                        {
                            "lang": "en",
                            "value": "AV:L - The flaw is in ntfs3 log_replay() during mount when parsing a crafted $LogFile on a block device; exploitation requires a local mount syscall or auto-mount of attacker-supplied removable media, not delivery through a network-facing kernel protocol handler.\nAC:L - An attacker fully controls malicious NTFS $LogFile journal fields (target_vcn, lcns_follow, page_lcns) and can craft the dirty-page-table state; KASAN reliably reproduced the slab OOB write on mount with no races or attacker-uncontrollable conditions.\nPR:N - No account or privileges on the victim are needed when a crafted NTFS volume on removable media is auto-mounted by udisks/systemd as root; alternatively an unprivileged user can trigger replay via user-namespace mount with CAP_SYS_ADMIN.\nUI:N - Once an attacker mounts or causes mount of a crafted NTFS image, log_replay() runs automatically inside ntfs_fill_super() with no further user interaction; the vulnerable copy_lcns path is reached during standard journal analysis on every affected mount attempt.\nS:U - Exploitation corrupts kernel heap memory during ntfs3 journal replay in the mounting process context; impact is privilege escalation within the same kernel/host security boundary, not a VM-guest-to-host or IOMMU boundary crossing.\nC:H - KASAN confirmed a slab out-of-bounds write of 8 bytes past dp->page_lcns[] in a kmalloc-backed DIR_PAGE_ENTRY; such heap corruption can overwrite adjacent slab objects and be groomed into arbitrary kernel memory read primitives.\nI:H - The bug is an out-of-bounds write into kernel heap metadata or adjacent objects beyond the allocated page_lcns[] array; per kernel guidance OOB writes enable controlled heap corruption paths toward arbitrary kernel writes and privilege escalation.\nA:H - KASAN reported slab-out-of-bounds write from log_replay() on mount; heap corruption during journal replay can cause immediate kernel oops/panic and is repeatable on each mount of a malicious NTFS volume, constituting high availability impact."
                        }
                    ]
                }
            ],
            "affected": [
                {
                    "product": "Linux",
                    "vendor": "Linux",
                    "defaultStatus": "unaffected",
                    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                    "programFiles": [
                        "fs/ntfs3/fslog.c"
                    ],
                    "versions": [
                        {
                            "version": "b46acd6a6a627d876898e1c84d3f84902264b445",
                            "lessThan": "9b3d8cc9d54fcded4de51b2b1026ae7182512077",
                            "status": "affected",
                            "versionType": "git"
                        },
                        {
                            "version": "b46acd6a6a627d876898e1c84d3f84902264b445",
                            "lessThan": "9b7c28d8c61bdb041936222a09a708531a1c2921",
                            "status": "affected",
                            "versionType": "git"
                        },
                        {
                            "version": "b46acd6a6a627d876898e1c84d3f84902264b445",
                            "lessThan": "0f13e823bf86bd1800168ea0bb5bca8b8500a81c",
                            "status": "affected",
                            "versionType": "git"
                        },
                        {
                            "version": "b46acd6a6a627d876898e1c84d3f84902264b445",
                            "lessThan": "d240cd98f5f7b65c90f6b2b6abe3232ccdc405ab",
                            "status": "affected",
                            "versionType": "git"
                        },
                        {
                            "version": "b46acd6a6a627d876898e1c84d3f84902264b445",
                            "lessThan": "49c86dae0c0ccb8d98ddcdc46987259389c816dd",
                            "status": "affected",
                            "versionType": "git"
                        },
                        {
                            "version": "b46acd6a6a627d876898e1c84d3f84902264b445",
                            "lessThan": "5e7b598660cfa8e5af172cf4c65cffc126333307",
                            "status": "affected",
                            "versionType": "git"
                        }
                    ]
                },
                {
                    "product": "Linux",
                    "vendor": "Linux",
                    "defaultStatus": "affected",
                    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                    "programFiles": [
                        "fs/ntfs3/fslog.c"
                    ],
                    "versions": [
                        {
                            "version": "5.15",
                            "status": "affected"
                        },
                        {
                            "version": "0",
                            "lessThan": "5.15",
                            "status": "unaffected",
                            "versionType": "semver"
                        },
                        {
                            "version": "6.1.178",
                            "lessThanOrEqual": "6.1.*",
                            "status": "unaffected",
                            "versionType": "semver"
                        },
                        {
                            "version": "6.6.145",
                            "lessThanOrEqual": "6.6.*",
                            "status": "unaffected",
                            "versionType": "semver"
                        },
                        {
                            "version": "6.12.97",
                            "lessThanOrEqual": "6.12.*",
                            "status": "unaffected",
                            "versionType": "semver"
                        },
                        {
                            "version": "6.18.40",
                            "lessThanOrEqual": "6.18.*",
                            "status": "unaffected",
                            "versionType": "semver"
                        },
                        {
                            "version": "7.1.5",
                            "lessThanOrEqual": "7.1.*",
                            "status": "unaffected",
                            "versionType": "semver"
                        },
                        {
                            "version": "7.2",
                            "lessThanOrEqual": "*",
                            "status": "unaffected",
                            "versionType": "original_commit_for_fix"
                        }
                    ]
                }
            ],
            "cpeApplicability": [
                {
                    "nodes": [
                        {
                            "operator": "OR",
                            "negate": false,
                            "cpeMatch": [
                                {
                                    "vulnerable": true,
                                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                                    "versionStartIncluding": "5.15",
                                    "versionEndExcluding": "6.1.178"
                                },
                                {
                                    "vulnerable": true,
                                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                                    "versionStartIncluding": "5.15",
                                    "versionEndExcluding": "6.6.145"
                                },
                                {
                                    "vulnerable": true,
                                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                                    "versionStartIncluding": "5.15",
                                    "versionEndExcluding": "6.12.97"
                                },
                                {
                                    "vulnerable": true,
                                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                                    "versionStartIncluding": "5.15",
                                    "versionEndExcluding": "6.18.40"
                                },
                                {
                                    "vulnerable": true,
                                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                                    "versionStartIncluding": "5.15",
                                    "versionEndExcluding": "7.1.5"
                                },
                                {
                                    "vulnerable": true,
                                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                                    "versionStartIncluding": "5.15",
                                    "versionEndExcluding": "7.2"
                                }
                            ]
                        }
                    ]
                }
            ],
            "references": [
                {
                    "url": "https://git.kernel.org/stable/c/9b3d8cc9d54fcded4de51b2b1026ae7182512077"
                },
                {
                    "url": "https://git.kernel.org/stable/c/9b7c28d8c61bdb041936222a09a708531a1c2921"
                },
                {
                    "url": "https://git.kernel.org/stable/c/0f13e823bf86bd1800168ea0bb5bca8b8500a81c"
                },
                {
                    "url": "https://git.kernel.org/stable/c/d240cd98f5f7b65c90f6b2b6abe3232ccdc405ab"
                },
                {
                    "url": "https://git.kernel.org/stable/c/49c86dae0c0ccb8d98ddcdc46987259389c816dd"
                },
                {
                    "url": "https://git.kernel.org/stable/c/5e7b598660cfa8e5af172cf4c65cffc126333307"
                }
            ],
            "title": "fs/ntfs3: bound copy_lcns dp->page_lcns[] index in analysis pass",
            "x_generator": {
                "engine": "bippy-1.2.0"
            }
        },
        "adp": [
            {
                "metrics": [
                    {
                        "other": {
                            "type": "ssvc",
                            "content": {
                                "id": "CVE-2026-72196",
                                "role": "CISA Coordinator",
                                "options": [
                                    {
                                        "Exploitation": "none"
                                    },
                                    {
                                        "Automatable": "no"
                                    },
                                    {
                                        "Technical Impact": "total"
                                    }
                                ],
                                "version": "2.0.3",
                                "timestamp": "2026-10-16T18:43:43.786684Z"
                            }
                        }
                    }
                ],
                "title": "CISA ADP Vulnrichment",
                "providerMetadata": {
                    "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
                    "shortName": "CISA-ADP",
                    "dateUpdated": "2026-10-16T18:45:01.462Z"
                }
            }
        ]
    }
}