---
id: CVE-2026-90118
title: "In the Linux kernel, the following vulnerability has been resolved:\n\nntfs: fix off-by-one page overflow in ntfs_decompress()\n\nThe per-token range check in ntfs_decompress() uses\n\n\tif (cb >= cb_sb_end || dp_addr > dp_sb_end)\n\t\tbreak;\n\nso …"
summary: "In the Linux kernel, the following vulnerability has been resolved:\n\nntfs: fix off-by-one page overflow in ntfs_decompress()\n\nThe per-token range check in ntfs_decompress() uses\n\n\tif (cb >= cb_sb_end || dp_addr > dp_sb_end)\n\t\tbreak;\n\nso …"
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 1e9ea7e04472d4e5e12e58c881eaacfb3e49b669 <
    b42644e425fed4a5cd6c88372655da5c1b52c666
  - >-
    Linux >= 1e9ea7e04472d4e5e12e58c881eaacfb3e49b669 <
    98716c9fce21f6c8a9d71e08cf53e7504fa562f4
  - Linux 7.1
published: '2026-09-17'
updated: '2026-09-18'
sourceUpdated: '2026-09-18T18:17:42.627'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-90118'
references:
  - url: 'https://git.kernel.org/stable/c/98716c9fce21f6c8a9d71e08cf53e7504fa562f4'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/b42644e425fed4a5cd6c88372655da5c1b52c666'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
  - cve.org
epss: 0.00174
epssPercentile: 0.0599
ingestedAt: '2026-09-17T16:21:47.885Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

ntfs: fix off-by-one page overflow in ntfs_decompress()

The per-token range check in ntfs_decompress() uses

	if (cb >= cb_sb_end || dp_addr > dp_sb_end)
		break;

so dp_addr == dp_sb_end falls through to the symbol copy
`*dp_addr++ = *cb++`, writing one byte past the destination page.  Since
NTFS_SB_SIZE == PAGE_SIZE the destination is a single page, so the byte
lands in the adjacent page, and *dest_ofs is left one past the sub-block
end (the later `*dest_ofs &= ~PAGE_MASK` then yields 1, not 0, so the page
is never finalized and later sub-blocks keep writing further past it).  A
corrupted compressed $DATA attribute thus produces a bounded run of
out-of-bounds writes when the file is read.

Break as soon as dp_addr reaches dp_sb_end; a full sub-block still
completes, as its final copy advances dp_addr to exactly dp_sb_end.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.