CVE-2026-72192: ntfs3: bound to_move in indx_insert_into_root before hdr_insert_head

In the Linux kernel, the following vulnerability has been resolved:

ntfs3: bound tomove in indxinsertintoroot before hdrinserthead

indxinsertintoroot() promotes a full resident $INDEXROOT into $INDEXALLOCATION and copies all non-last resident root entries into a newly allocated INDEXBUFFER via hdrinserthead(). The source byte count 'tomove' is summed from the on-disk resident entry sizes and is independent of the destination buffer size, which comes from root->indexblocksize (via indx->indexbits).

A crafted NTFS image that keeps a valid, full resident root but shrinks root->indexblocksize down to 512 after the root has been populated makes hdrinserthead() memcpy attacker-controlled resident entry bytes past the end of the kmalloc(1u << indx->indexbits) allocation returned by indxnew(). For a 512-byte destination and a resident root whose non-last entries total 560 bytes, the memcpy overruns by 120 bytes and a following memmove extends the highest written offset to 136 bytes past the allocation. The overflow bytes are a direct copy of on-disk entries (via kmemdup), so they are fully attacker-controlled.

The write is reachable from unprivileged open(OCREAT) on a mounted crafted NTFS image: a single sufficiently long create in a directory whose resident root is already full forces root promotion and triggers the copy.

This is a controlled out-of-bounds write of 120-136 bytes past a kmalloc(indexblocksize) allocation, with attacker-controlled content. It is a bounded adjacent-heap corruption primitive; it is not an arbitrary-address write. Successful exploitation into a named victim object depends on the surrounding slab layout.

Reject the copy at the sink. The destination's INDEXHDR already reports hdrtotal (the payload capacity of the new buffer) and hdrused (the bytes already consumed by the terminal END entry installed by indxnew()); require that tomove fits in the remaining payload before calling hdrinserthead(). On mismatch, fail with -EINVAL and mark the filesystem as having a detected on-disk inconsistency, which is the same behaviour as the surrounding validation in this function.