{"id":7149,"date":"2026-09-04T18:49:26","date_gmt":"2026-09-04T10:49:26","guid":{"rendered":"https:\/\/www.54iter.cn\/?vuln=cve-2026-72478"},"modified":"2026-09-04T18:49:26","modified_gmt":"2026-09-04T10:49:26","slug":"cve-2026-72478","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-72478","title":{"rendered":"CVE-2026-72478 [HIGH] &#8211; In the Linux kernel, the following vulnerability has been resolved:\n\nfs\/ntfs3: add bounds"},"content":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>fs\/ntfs3: add bounds check to run_get_highest_vcn()<\/p>\n<p>run_get_highest_vcn() parses a packed NTFS mapping-pairs buffer without<br \/>\nany length bound, relying solely on a 0x00 terminator to stop.  A<br \/>\ncrafted $LogFile UpdateMappingPairs record whose embedded attribute<br \/>\ncontains mapping-pairs runs without a terminator causes the function to<br \/>\nread past the slab allocation, triggering a KASAN slab-out-of-bounds<br \/>\nread on mount.<\/p>\n<p>The sibling function run_unpack() received an analogous bounds-check in<br \/>\ncommit b62567bca474 (&#8220;ntfs3: add buffer boundary checks to run_unpack()&#8221;),<br \/>\nbut run_get_highest_vcn() was missed.<\/p>\n<p>Take a run_buf_size parameter and reject any run header whose payload<br \/>\nwould extend past the buffer end, mirroring the pattern used by<br \/>\nrun_unpack().  The caller in fslog.c passes the remaining attribute<br \/>\nbytes after the mapping-pairs offset.<\/p>\n<p>KASAN report (on mainline v7.1 merge window HEAD):<\/p>\n<p>  BUG: KASAN: slab-out-of-bounds in run_get_highest_vcn+0x3c0\/0x410<br \/>\n  Read of size 1 at addr ffff88800e2d5400 by task mount\/72<br \/>\n  Call Trace:<br \/>\n   run_get_highest_vcn+0x3c0\/0x410<br \/>\n   do_action.isra.0+0x3ba8\/0x7b50<br \/>\n   log_replay+0x9ddd\/0x10200<br \/>\n   ntfs_loadlog_and_replay+0x4ad\/0x610<br \/>\n   ntfs_fill_super+0x214a\/0x4540<\/p>\n","protected":false},"excerpt":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>fs\/ntfs3: add bounds check to run_get_highest_vcn()<\/p>\n<p>run_get_highest_vcn() parses a packed NTFS mapping-pairs buffer without<br \/>\nany le<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-7149","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/7149","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=7149"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=7149"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=7149"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}