CVE-2026-72197: fs/ntfs3: bound DeleteIndexEntryAllocation memmove length
In the Linux kernel, the following vulnerability has been resolved:
fs/ntfs3: bound DeleteIndexEntryAllocation memmove length
In doaction()'s DeleteIndexEntryAllocation case, e->size comes from an on-disk INDEXBUFFER entry. When e->size makes e + e->size point past hdr + hdr->used, PtrOffset(e1, Add2Ptr(hdr, used)) returns a negative ptrdifft that is silently cast to a quasi-infinite sizet when passed to memmove(). The memmove then walks past the destination buffer.
The sibling DeleteIndexEntryRoot case at fslog.c:3540-3543 already carries the corresponding guard:
if (PtrOffset(e1, Add2Ptr(hdr, used)) < esize || Add2Ptr(e, esize) > Add2Ptr(lrh, reclen) || used + esize > le32tocpu(hdr->total)) { goto dirtyvol; }
Apply the same shape to the allocation-path case. Also reject esize == 0: memmove(e, e, ...) is a no-op and leaves hdr->used unchanged, hiding a malformed entry from the existing checkindexheader() walk.
Reproduced under UML+KASAN on mainline 8d90b09e6741 by mounting a crafted NTFS image: the unguarded memmove takes a length of 0xffffffffffffff00 and the kernel oopses in memmove+0x81/0x1a0 on the doaction+0x36a2 frame.
[almaz.alexandrovich@paragon-software.com: clang-formatted the changes]
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
In do_action()’s DeleteIndexEntryAllocation case, add the missing guard so the memmove length is bounded by verifying `PtrOffset(e1, Add2Ptr(hdr, used)) < esize` and rejecting when `used + esize > le32_to_cpu(hdr->total)`; only then call memmove (goto dirty_vol on failure). Apply the same shape to the allocation-path case and mirror the guard for the sibling DeleteIndexEntryRoot handling at fslog.c:3540-3543.
Linux kernel (fs/ntfs3) bound DeleteIndexEntryAllocation memmove length = Add/ensure check that PtrOffset(e1, Add2Ptr(hdr, used)) < esize (and used + esize > le32_to_cpu(hdr->total) rejected) before memmove