CVE-2026-43245: ntfs: ->d_compare() must not block
In the Linux kernel, the following vulnerability has been resolved:
ntfs: ->dcompare() must not block
... so don't use getname() there. Switch it (and ntfsdhash(), while we are at it) to kmalloc(PATHMAX, GFPNOWAIT). Yes, ntfsdhash() almost certainly can do with smaller allocations, but let ntfs folks deal with that - keep the allocation size as-is for now.
Stop abusing namescachep in ntfs, period - various uses of that thing in there have nothing to do with pathnames; just use k[mz]alloc() and be done with that. For now let's keep sizes as-in, but AFAICS none of the users actually want PATHMAX.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.113-1Fixed in 7.2.12-1Fixed in 7.2.14-1
Event History
Frequently Asked Questions
What is the severity of CVE-2026-43245?
CVE-2026-43245 has a medium severity rating, as it affects the functionality of the Linux kernel's NTFS file system operations.
How do I fix CVE-2026-43245?
To fix CVE-2026-43245, update your Linux kernel to the latest version that includes the patch for this vulnerability.
What systems are affected by CVE-2026-43245?
CVE-2026-43245 affects all versions of the Linux kernel that handle NTFS when not patched.
What type of vulnerability is CVE-2026-43245?
CVE-2026-43245 is a blocking issue in the Linux kernel related to file system operations.
Is there a known exploit for CVE-2026-43245?
As of now, there are no known public exploits for CVE-2026-43245.