In the Linux kernel, the following vulnerability has been resolved:

ntfs3: fix integer overflow in rununpack() volume boundary check

The volume boundary check lcn + len > sbi->used.bitmap.nbits uses raw addition which can wrap around for large lcn and len values, bypassing the validation. Use checkaddoverflow() as is already done for the adjacent prevlcn + dlcn and vcn64 + len checks added by commit 3ac37e100385 ("ntfs3: Fix integer overflow in rununpack()").

Found by fuzzing with a source-patched harness (LibAFL + QEMU).

In the Linux kernel, the following vulnerability has been resolved:

fs/ntfs3: handle attrsetsize() errors when truncating files

If attrsetsize() fails while truncating down, the error is silently ignored and the inode may be left in an inconsistent state.

fs/ntfs3: terminate the cached volume label after UTF-8 conversion