---
id: CVE-2026-72478
title: 'fs/ntfs3: add bounds check to run_get_highest_vcn()'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  fs/ntfs3: add bounds check to run_get_highest_vcn()

  run_get_highest_vcn() parses a packed NTFS mapping-pairs buffer without
  any length bound, relying solely on a 0x00 …
severity: high
cvss: 8.4
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 425de2aba0d061b3e715d51a3b1992c112ed5b99 <
    c69b9003332917b652175d5fa9d84158c5ed8617
  - >-
    Linux >= bf7ac4a1d3bfc6e56e54635c3d331a68170d37c9 <
    8afc24a884aff6a6f08028bd779ee65c40054455
  - >-
    Linux >= e64f7dfcaff79e7dfff9121a382dd77f9b462f62 <
    c23083b472a720c3f60b147db05b25b751c7c1bf
  - >-
    Linux >= d3012690a7065d9ca86521a525ad11e8af491d45 <
    a31893206588374d7d16fad387189d8165c7efd3
  - >-
    Linux >= b62567bca47408e6739dee75f02a2113548af875 <
    41081202eb823f5b27ff164b12010b24428100ad
  - >-
    Linux >= b62567bca47408e6739dee75f02a2113548af875 <
    bb11485a87fbb2254b62cfed630b699d50e57da8
  - Linux bbad75336870b51b81979b97613746237fcb02fe
  - Linux 41aadf5cb482793a24e05aa136224e179a778586
  - Linux >= 6.1.175 < 6.1.178
  - Linux >= 6.6.140 < 6.6.145
  - Linux >= 6.12.86 < 6.12.97
  - Linux >= 6.18.27 < 6.18.40
  - Linux >= 5.15.209 < 5.16
  - Linux >= 7.0.4 < 7.1
  - Linux 7.1
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-16T18:50:38.730753Z'
published: '2026-08-15'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T18:55:26.034Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-72478'
references:
  - url: 'https://git.kernel.org/stable/c/c69b9003332917b652175d5fa9d84158c5ed8617'
  - url: 'https://git.kernel.org/stable/c/8afc24a884aff6a6f08028bd779ee65c40054455'
  - url: 'https://git.kernel.org/stable/c/c23083b472a720c3f60b147db05b25b751c7c1bf'
  - url: 'https://git.kernel.org/stable/c/a31893206588374d7d16fad387189d8165c7efd3'
  - url: 'https://git.kernel.org/stable/c/41081202eb823f5b27ff164b12010b24428100ad'
  - url: 'https://git.kernel.org/stable/c/bb11485a87fbb2254b62cfed630b699d50e57da8'
tags:
  - cve.org
epss: 0.00196
epssPercentile: 0.08646
ingestedAt: '2026-10-16T19:46:24.392Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

fs/ntfs3: add bounds check to run_get_highest_vcn()

run_get_highest_vcn() parses a packed NTFS mapping-pairs buffer without
any length bound, relying solely on a 0x00 terminator to stop.  A
crafted $LogFile UpdateMappingPairs record whose embedded attribute
contains mapping-pairs runs without a terminator causes the function to
read past the slab allocation, triggering a KASAN slab-out-of-bounds
read on mount.

The sibling function run_unpack() received an analogous bounds-check in
commit b62567bca474 ("ntfs3: add buffer boundary checks to run_unpack()"),
but run_get_highest_vcn() was missed.

Take a run_buf_size parameter and reject any run header whose payload
would extend past the buffer end, mirroring the pattern used by
run_unpack().  The caller in fslog.c passes the remaining attribute
bytes after the mapping-pairs offset.

KASAN report (on mainline v7.1 merge window HEAD):

  BUG: KASAN: slab-out-of-bounds in run_get_highest_vcn+0x3c0/0x410
  Read of size 1 at addr ffff88800e2d5400 by task mount/72
  Call Trace:
   run_get_highest_vcn+0x3c0/0x410
   do_action.isra.0+0x3ba8/0x7b50
   log_replay+0x9ddd/0x10200
   ntfs_loadlog_and_replay+0x4ad/0x610
   ntfs_fill_super+0x214a/0x4540

## Affected

- `Linux >= 425de2aba0d061b3e715d51a3b1992c112ed5b99 < c69b9003332917b652175d5fa9d84158c5ed8617`
- `Linux >= bf7ac4a1d3bfc6e56e54635c3d331a68170d37c9 < 8afc24a884aff6a6f08028bd779ee65c40054455`
- `Linux >= e64f7dfcaff79e7dfff9121a382dd77f9b462f62 < c23083b472a720c3f60b147db05b25b751c7c1bf`
- `Linux >= d3012690a7065d9ca86521a525ad11e8af491d45 < a31893206588374d7d16fad387189d8165c7efd3`
- `Linux >= b62567bca47408e6739dee75f02a2113548af875 < 41081202eb823f5b27ff164b12010b24428100ad`
- `Linux >= b62567bca47408e6739dee75f02a2113548af875 < bb11485a87fbb2254b62cfed630b699d50e57da8`
- `Linux bbad75336870b51b81979b97613746237fcb02fe`
- `Linux 41aadf5cb482793a24e05aa136224e179a778586`
- `Linux >= 6.1.175 < 6.1.178`
- `Linux >= 6.6.140 < 6.6.145`
- `Linux >= 6.12.86 < 6.12.97`
- `Linux >= 6.18.27 < 6.18.40`
- `Linux >= 5.15.209 < 5.16`
- `Linux >= 7.0.4 < 7.1`
- `Linux 7.1`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.