CVE-2026-72210: ntfs: fix off-by-one in mapping pairs decoding bounds checks
In the Linux kernel, the following vulnerability has been resolved:
ntfs: fix off-by-one in mapping pairs decoding bounds checks
In ntfsmappingpairsdecompress(), attrend points one byte past the end of the attribute record:
attrend = (u8 )attr + le32tocpu(attr->length);
The two bounds checks validating that mapping pair data bytes fit within the attribute use strict greater-than (>), which allows a one-byte out-of-bounds read when the data extends exactly to attrend:
b = buf & 0xf; if (b) { if (unlikely(buf + b > attrend)) // off-by-one goto ioerror; for (deltaxcn = (s8)buf[b--]; b; b--) deltaxcn = (deltaxcn << 8) + buf[b]; }
When buf + b == attrend, the check evaluates to false and buf[b] reads one byte past the valid attribute boundary. The same pattern appears in the LCN delta bytes check.
Fix both checks to use >= so that buf[b] at exactly attrend is correctly rejected as out of bounds.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
In ntfs_mapping_pairs_decompress(), change the bounds checks for mapping pair data bytes to use >= instead of > so that when buf + b == attr_end the access is allowed (and buf[b] at exactly attr_end is not rejected/treated as out-of-bounds). Specifically address the off-by-one in checks like 'if (unlikely(buf + b > attr_end))' to become '>=', and apply the same >= pattern to the related LCN delta bytes check.
Linux kernel (ntfs mapping pairs decoding) mapping pairs bounds checks = >= (change strict > to non-strict >=)