CVE-2026-53023: fs/ntfs3: terminate the cached volume label after UTF-8 conversion
fs/ntfs3: terminate the cached volume label after UTF-8 conversion
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.143.1-1 - Configuration
Update the fs/ntfs3 code so that after utf16s_to_utf8s() conversion completes successfully and writes into sbi->volume.label, the cached volume label is explicitly terminated; if the converted label fills the entire fixed buffer (exact-full case), clamp to the last byte of the buffer so a terminator is present, preventing ntfs3_label_show() from reading past the end.
Linux kernel (fs/ntfs3) Terminate cached volume label after UTF-8 conversion = Explicitly clamp the exact-full case to the last byte of the buffer and ensure NUL termination after successful conversion
Event History
Frequently Asked Questions
What is the severity of CVE-2026-53023?
CVE-2026-53023 has a severity rating of high, with a score of 7.1.
What systems are affected by CVE-2026-53023?
CVE-2026-53023 affects the Linux kernel, specifically the ntfs3 module.
What kind of vulnerability is CVE-2026-53023?
CVE-2026-53023 is a vulnerability related to the termination of the cached volume label after UTF-8 conversion in the Linux kernel.
How do I fix CVE-2026-53023?
Fixing CVE-2026-53023 requires updating to the latest patched version of the Linux kernel that addresses this vulnerability.
What are the implications of CVE-2026-53023?
Exploiting CVE-2026-53023 can potentially lead to information disclosure due to improper handling of volume labels in the ntfs3 filesystem.