CVE-2026-72210: ntfs: fix off-by-one in mapping pairs decoding bounds checks
In the Linux kernel, the following vulnerability has been resolved:
ntfs: fix off-by-one in mapping pairs decoding bounds checks
In ntfsmappingpairsdecompress(), attrend points one byte past the end of the attribute record:
attrend = (u8 )attr + le32tocpu(attr->length);
The two bounds checks validating that mapping pair data bytes fit within the attribute use strict greater-than (>), which allows a one-byte out-of-bounds read when the data extends exactly to attrend:
b = buf & 0xf; if (b) { if (unlikely(buf + b > attrend)) // off-by-one goto ioerror; for (deltaxcn = (s8)buf[b--]; b; b--) deltaxcn = (deltaxcn << 8) + buf[b]; }
When buf + b == attrend, the check evaluates to false and buf[b] reads one byte past the valid attribute boundary. The same pattern appears in the LCN delta bytes check.
Fix both checks to use >= so that buf[b] at exactly attrend is correctly rejected as out of bounds.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
In ntfs_mapping_pairs_decompress(), change the bounds checks for mapping pair data bytes to use >= instead of > so that when buf + b == attr_end the access is allowed (and buf[b] at exactly attr_end is not rejected/treated as out-of-bounds). Specifically address the off-by-one in checks like 'if (unlikely(buf + b > attr_end))' to become '>=', and apply the same >= pattern to the related LCN delta bytes check.
Linux kernel (ntfs mapping pairs decoding) mapping pairs bounds checks = >= (change strict > to non-strict >=)
Event History
Frequently Asked Questions
What is the severity of CVE-2026-72210?
CVE-2026-72210 has a risk rating of 17, indicating a significant vulnerability in the Linux kernel.
How do I fix CVE-2026-72210?
To fix CVE-2026-72210, ensure that you update your Linux kernel to the latest version that addresses this vulnerability.
What systems are affected by CVE-2026-72210?
CVE-2026-72210 affects systems utilizing the NTFS file system within the Linux kernel.
What type of vulnerability is CVE-2026-72210?
CVE-2026-72210 is an off-by-one vulnerability that occurs during the decoding of mapping pairs in the NTFS file system.
When was CVE-2026-72210 published?
CVE-2026-72210 was published on August 15, 2026.