Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-72478— fs/ntfs3: add bounds check to run_get_highest_vcn()

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会开源的一个操作系统内核。 Linux kernel存在安全漏洞，该漏洞源于run_get_highest_vcn()函数解析NTFS映射对缓冲区时缺少长度边界检查，可能导致挂载时越界读取。

CVSS 8.4 · High EPSS 0.15% · P5

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Affected Version Matrix 22

VendorProduct Version RangeStatus
Linux Linux 425de2aba0d061b3e715d51a3b1992c112ed5b99< c69b9003332917b652175d5fa9d84158c5ed8617 affected
bf7ac4a1d3bfc6e56e54635c3d331a68170d37c9< 8afc24a884aff6a6f08028bd779ee65c40054455 affected
e64f7dfcaff79e7dfff9121a382dd77f9b462f62< c23083b472a720c3f60b147db05b25b751c7c1bf affected
d3012690a7065d9ca86521a525ad11e8af491d45< a31893206588374d7d16fad387189d8165c7efd3 affected
b62567bca47408e6739dee75f02a2113548af875< 41081202eb823f5b27ff164b12010b24428100ad affected
b62567bca47408e6739dee75f02a2113548af875< bb11485a87fbb2254b62cfed630b699d50e57da8 affected
bbad75336870b51b81979b97613746237fcb02fe affected
41aadf5cb482793a24e05aa136224e179a778586 affected
… +14 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-72478

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
fs/ntfs3: add bounds check to run_get_highest_vcn()
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: add bounds check to run_get_highest_vcn() run_get_highest_vcn() parses a packed NTFS mapping-pairs buffer without any length bound, relying solely on a 0x00 terminator to stop. A crafted $LogFile UpdateMappingPairs record whose embedded attribute contains mapping-pairs runs without a terminator causes the function to read past the slab allocation, triggering a KASAN slab-out-of-bounds read on mount. The sibling function run_unpack() received an analogous bounds-check in commit b62567bca474 ("ntfs3: add buffer boundary checks to run_unpack()"), but run_get_highest_vcn() was missed. Take a run_buf_size parameter and reject any run header whose payload would extend past the buffer end, mirroring the pattern used by run_unpack(). The caller in fslog.c passes the remaining attribute bytes after the mapping-pairs offset. KASAN report (on mainline v7.1 merge window HEAD): BUG: KASAN: slab-out-of-bounds in run_get_highest_vcn+0x3c0/0x410 Read of size 1 at addr ffff88800e2d5400 by task mount/72 Call Trace: run_get_highest_vcn+0x3c0/0x410 do_action.isra.0+0x3ba8/0x7b50 log_replay+0x9ddd/0x10200 ntfs_loadlog_and_replay+0x4ad/0x610 ntfs_fill_super+0x214a/0x4540
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会开源的一个操作系统内核。 Linux kernel存在安全漏洞，该漏洞源于run_get_highest_vcn()函数解析NTFS映射对缓冲区时缺少长度边界检查，可能导致挂载时越界读取。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux 425de2aba0d061b3e715d51a3b1992c112ed5b99 ~ c69b9003332917b652175d5fa9d84158c5ed8617 -
Linux Linux 7.1 -

II. Public POCs for CVE-2026-72478

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-72478

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-72478 (6)

Same Patch Batch · Linux · 2026-08-15 · 845 CVEs total

CVE-2026-74475 10.0 CRITICAL vxlan: use neigh_ha_snapshot() in route_shortcircuit()
CVE-2026-74280 10.0 CRITICAL crypto: marvell/octeontx - fix DMA cleanup using wrong loop index
CVE-2026-74279 10.0 CRITICAL crypto: cavium/cpt - fix DMA cleanup using wrong loop index
CVE-2026-72421 10.0 CRITICAL ipv4: fib: Don't ignore error route in local/main tables.
CVE-2026-74309 10.0 CRITICAL vdpa/octeon_ep: fix IRQ-to-ring mapping in interrupt handler
CVE-2026-72407 10.0 CRITICAL geneve: validate inner network offset in geneve_gro_complete()
CVE-2026-72408 10.0 CRITICAL geneve: gate GRO hint in geneve_gro_complete() on gs->gro_hint
CVE-2026-72493 9.9 CRITICAL net: serialize netif_running() check in enqueue_to_backlog()
CVE-2026-72299 9.8 CRITICAL tipc: restrict socket queue dumps in enqueue tracepoints
CVE-2026-72472 9.8 CRITICAL nfs: use nfsi->rwsem to protect traversal of the file lock list
CVE-2026-72473 9.8 CRITICAL xprtrdma: Decouple req recycling from RPC completion
CVE-2026-72466 9.8 CRITICAL xprtrdma: Fix bcall rep leak and unbounded peek
CVE-2026-74433 9.8 CRITICAL rxrpc: Fix UAF in rxgk_issue_challenge()
CVE-2026-74434 9.8 CRITICAL rxrpc: Don't move a peeked OOB message onto the pending queue
CVE-2026-72210 9.8 CRITICAL ntfs: fix off-by-one in mapping pairs decoding bounds checks
CVE-2026-72033 9.8 CRITICAL orangefs: keep the readdir entry size 64-bit in fill_from_part()
CVE-2026-74436 9.8 CRITICAL rxrpc: serialize kernel accept preallocation with socket teardown
CVE-2026-74545 9.8 CRITICAL rtase: fix double free of multi-frag skb on DMA map failure
CVE-2026-72211 9.8 CRITICAL ntfs: grow index root value before reparent header update
CVE-2026-72209 9.8 CRITICAL ntfs: validate attribute values on lookup

Showing top 20 of 845 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2026-72478

No comments yet

Leave a comment