Linux Kernel ntfs3 CVE-2026-72195

The vulnerability resides in do_action()'s UpdateResidentValue case in fs/ntfs3/fslog.c (around line 3307). The NTFS Log File Service (LFS) stores Log Record Headers (LRHs) on-disk containing attr_off and redo_len fields. When those fields satisfy the condition aoff + dlen < attr->res.data_off (the resident attribute's data offset), the subtraction aoff + dlen - data_off wraps around because these are unsigned 32-bit quantities, yielding a value near 4 GiB (e.g., 0xFFFFFFF9 for aoff=0x10, dlen=1, data_off=0x18). This underflowed value is stored as attr->res.data_size, causing subsequent attribute-payload walks to read far beyond the 1024-byte MFT record boundary - an out-of-bounds kernel memory read. The existing defense in mi_enum_attr() at record.c:287 catches the corrupted size during full attribute enumeration and fails the mount, but code paths that fetch attributes by name and read data_size directly bypass this check. The fix validates attr_off against data_off and the attribute size at the assignment site. No CWE identifier was assigned, but this is structurally an integer underflow (CWE-191) leading to an out-of-bounds read (CWE-125). The ntfs3 driver was introduced in Linux 5.15 and the vulnerable commit is b46acd6a6a627d876898e1c84d3f84902264b445.