UBUNTU-CVE-2026-97438: High severity ubuntu/linux vulnerability
In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: validate index entry key bounds [BUG] A malformed NTFS directory index entry can advertise a keysize larger than the bytes actually present in its NTFSDE payload. Directory lookup then passes that malformed key to cmpfnames(), which can read past the end of the kmalloc'ed index buffer. BUG: KASAN: slab-out-of-bounds in fnamefullsize fs/ntfs3/ntfs.h:590 [inline] BUG: KASAN: slab-out-of-bounds in cmpfnames+0x1ea/0x230 fs/ntfs3/index.c:46 Read of size 1 at addr ffff88801c313018 by task syz.6.3365/9279 Call Trace: dumpstack lib/dumpstack.c:94 [inline] dumpstacklvl+0xbe/0x130 lib/dumpstack.c:120 printaddressdescription mm/kasan/report.c:378 [inline] printreport+0xd1/0x650 mm/kasan/report.c:482 kasanreport+0xfb/0x140 mm/kasan/report.c:595 asanreportload1noabort+0x14/0x30 mm/kasan/reportgeneric.c:378 fnamefullsize fs/ntfs3/ntfs.h:590 [inline] cmpfnames+0x1ea/0x230 fs/ntfs3/index.c:46 hdrfinde.isra.0+0x3ed/0x670 fs/ntfs3/index.c:762 indxfind+0x4b5/0x900 fs/ntfs3/index.c:1186 dirsearchu+0x2c0/0x460 fs/ntfs3/dir.c:254 ntfslookup+0x1cc/0x2a0 fs/ntfs3/namei.c:85 lookupslow+0x241/0x450 fs/namei.c:1816 lookupslow fs/namei.c:1833 [inline] walkcomponent+0x31c/0x570 fs/namei.c:2151 linkpathwalk+0x592/0xd60 fs/namei.c:2519 pathlookupat+0x138/0x660 fs/namei.c:2675 filenamelookup+0x1f3/0x560 fs/namei.c:2705 filenamesetxattr+0xad/0x1c0 fs/xattr.c:660 pathsetxattrat+0x1d8/0x280 fs/xattr.c:713 dosyslsetxattr fs/xattr.c:754 [inline] sesyslsetxattr fs/xattr.c:750 [inline] x64syslsetxattr+0xd0/0x150 fs/xattr.c:750 ... Allocated by task 9279: kasansavestack+0x39/0x70 mm/kasan/common.c:56 kasansavetrack+0x14/0x40 mm/kasan/common.c:77 kasansaveallocinfo+0x37/0x60 mm/kasan/generic.c:573 poisonkmallocredzone mm/kasan/common.c:400 [inline] kasankmalloc+0xc3/0xd0 mm/kasan/common.c:417 kasankmalloc include/linux/kasan.h:262 [inline] dokmallocnode mm/slub.c:5650 [inline] kmallocnoprof+0x2bd/0x900 mm/slub.c:5662 kmallocnoprof include/linux/slab.h:961 [inline] indxread+0x41d/0xad0 fs/ntfs3/index.c:1059 indxfind+0x447/0x900 fs/ntfs3/index.c:1179 dirsearchu+0x2c0/0x460 fs/ntfs3/dir.c:254 ntfslookup+0x1cc/0x2a0 fs/ntfs3/namei.c:85 lookupslow+0x241/0x450 fs/namei.c:1816 lookupslow fs/namei.c:1833 [inline] walkcomponent+0x31c/0x570 fs/namei.c:2151 linkpathwalk+0x592/0xd60 fs/namei.c:2519 pathlookupat+0x138/0x660 fs/namei.c:2675 filenamelookup+0x1f3/0x560 fs/namei.c:2705 filenamesetxattr+0xad/0x1c0 fs/xattr.c:660 pathsetxattrat+0x1d8/0x280 fs/xattr.c:713 dosyslsetxattr fs/xattr.c:754 [inline] sesyslsetxattr fs/xattr.c:750 [inline] x64syslsetxattr+0xd0/0x150 fs/xattr.c:750 ... [CAUSE] The index-header validators only validated INDEXHDR-level geometry. They did not walk each NTFSDE to verify entry alignment, subnode layout, or that keysize fit inside the entry payload. They also allowed a last sentinel entry to carry a non-zero keysize. [FIX] Walk every NTFSDE in ntfs3's index-header validators and reject entries with invalid layout, mismatched subnode state, oversized keysize, or non-zero sentinel keys before lookup or log replay can consume them.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-aws-5.15to a version that resolves this vulnerability.Fixed in 5.15.0-1119.126~20.04.1 - Upgrade
Upgrade
ubuntu/linux-azure-5.15to a version that resolves this vulnerability.Fixed in 5.15.0-1125.134~20.04.1 - Upgrade
Upgrade
ubuntu/linux-azure-fde-5.15to a version that resolves this vulnerability.Fixed in 5.15.0-1124.133~20.04.1 - Upgrade
Upgrade
ubuntu/linux-gcp-5.15to a version that resolves this vulnerability.Fixed in 5.15.0-1120.130~20.04.1 - Upgrade
Upgrade
ubuntu/linux-hwe-5.15to a version that resolves this vulnerability.Fixed in 5.15.0-202.212~20.04.1 - Upgrade
Upgrade
ubuntu/linux-ibm-5.15to a version that resolves this vulnerability.Fixed in 5.15.0-1113.117~20.04.1 - Upgrade
Upgrade
ubuntu/linux-intel-iotg-5.15to a version that resolves this vulnerability.Fixed in 5.15.0-1114.120~20.04.1 - Upgrade
Upgrade
ubuntu/linux-lowlatency-hwe-5.15to a version that resolves this vulnerability.Fixed in 5.15.0-197.207~20.04.1 - Upgrade
Upgrade
ubuntu/linux-nvidia-tegra-5.15to a version that resolves this vulnerability.Fixed in 5.15.0-1070.72~20.04.1 - Upgrade
Upgrade
ubuntu/linux-oracle-5.15to a version that resolves this vulnerability.Fixed in 5.15.0-1116.122~20.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-5.15to a version that resolves this vulnerability.Fixed in 5.15.0-1113.117~20.04.2 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 5.15.0-202.212 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 5.15.0-1119.126 - Upgrade
Upgrade
ubuntu/linux-azureto a version that resolves this vulnerability.Fixed in 5.15.0-1125.134 - Upgrade
Upgrade
ubuntu/linux-azure-fdeto a version that resolves this vulnerability.Fixed in 5.15.0-1124.133 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 5.15.0-1120.130 - Upgrade
Upgrade
ubuntu/linux-gketo a version that resolves this vulnerability.Fixed in 5.15.0-1115.121 - Upgrade
Upgrade
ubuntu/linux-gkeopto a version that resolves this vulnerability.Fixed in 5.15.0-1102.110 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 5.15.0-1113.117 - Upgrade
Upgrade
ubuntu/linux-intel-iotgto a version that resolves this vulnerability.Fixed in 5.15.0-1114.120 - Upgrade
Upgrade
ubuntu/linux-kvmto a version that resolves this vulnerability.Fixed in 5.15.0-1111.116 - Upgrade
Upgrade
ubuntu/linux-lowlatencyto a version that resolves this vulnerability.Fixed in 5.15.0-197.207 - Upgrade
Upgrade
ubuntu/linux-nvidiato a version that resolves this vulnerability.Fixed in 5.15.0-1114.115 - Upgrade
Upgrade
ubuntu/linux-nvidia-tegrato a version that resolves this vulnerability.Fixed in 5.15.0-1070.72 - Upgrade
Upgrade
ubuntu/linux-nvidia-tegra-igxto a version that resolves this vulnerability.Fixed in 5.15.0-1059.59 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 5.15.0-1116.122 - Upgrade
Upgrade
ubuntu/linux-bluefieldto a version that resolves this vulnerability.Fixed in 5.15.0-1103.105 - Upgrade
Upgrade
ubuntu/linux-intel-iot-realtimeto a version that resolves this vulnerability.Fixed in 5.15.0-1111.115 - Upgrade
Upgrade
ubuntu/linux-realtimeto a version that resolves this vulnerability.Fixed in 5.15.0-1118.127 - Upgrade
Upgrade
ubuntu/linux-aws-fipsto a version that resolves this vulnerability.Fixed in 5.15.0-1119.126+fips1 - Upgrade
Upgrade
ubuntu/linux-azure-fipsto a version that resolves this vulnerability.Fixed in 5.15.0-1125.134+fips1 - Upgrade
Upgrade
ubuntu/linux-fipsto a version that resolves this vulnerability.Fixed in 5.15.0-202.212+fips1 - Upgrade
Upgrade
ubuntu/linux-gcp-fipsto a version that resolves this vulnerability.Fixed in 5.15.0-1120.130+fips1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1