EUVD-2026-76522
GHSA-whjw-7h99-rmg2
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Exploitation requires locally mounting a crafted NTFS image (AV:L), typically needing mount privilege (PR:L); once decoded, memory corruption plausibly yields full C/I/A impact.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
ntfs: verify run length exceeding volume boundary
The mapping pairs decoder validates that the starting LCN is within the volume but does not check if the run extends beyond the volume boundary.
A malformed NTFS image with a crafted mapping pairs array could cause the kernel to access memory beyond the volume boundary, potentially leading to memory corruption and privilege escalation.
Add validation to ensure lcn + length stays within nr_clusters.
AnalysisAI
Out-of-bounds memory access in the Linux kernel's NTFS (ntfs3) driver arises because the mapping-pairs runlist decoder confirms that a run's starting LCN falls inside the volume but never checks that the run's end (lcn + length) also stays within nr_clusters. Mounting or parsing a crafted NTFS image can therefore drive the kernel to reference clusters beyond the volume boundary, corrupting memory and potentially escalating privilege. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires the target to mount or otherwise parse an attacker-controlled NTFS volume using the Linux kernel's ntfs3 driver - i.e., the malicious image must reach the mapping-pairs decoder. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The published CVSS of 9.8 (AV:N/AC:L/PR:N/UI:N) is substantially overstated for this class of bug: exploitation requires the victim system to mount or process an attacker-supplied NTFS image, which is a local, filesystem-parsing operation rather than a remotely reachable network service - a realistic vector is AV:L, typically gated on either mount privileges or an automount/USB-insertion path. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to a fixed kernel: Vendor-released patch: Linux 7.2.4 (also fixed in 7.3-rc1); apply the corresponding distribution backport once available, since the fix simply adds a bounds check ensuring lcn + length stays within nr_clusters. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: identify all Linux systems running kernel versions below 7.2.4 with the NTFS3 driver enabled, prioritizing production infrastructure and systems accessible to non-administrators. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today