EUVD-2026-76525
GHSA-674g-rrmx-c6rx
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Exploitation requires mounting an attacker-supplied NTFS image (local, typically privileged/automount-gated), so AV:L/PR:L; impact is primarily a kernel crash (A:H) with limited OOB read/write (C:L/I:L).
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
ntfs: reject invalid empty mapping pairs
Reject an attribute with empty mapping pairs if it has inconsistent highest VCN and size.
AnalysisAI
Improper metadata validation in the Linux kernel's NTFS3 filesystem driver allows a crafted NTFS image to pass consistency checks when an attribute declares empty mapping pairs while carrying an inconsistent highest VCN and size. Parsing such an attribute can drive out-of-bounds memory access during runlist decoding, leading to memory corruption or a denial of service when the malicious image is mounted. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires the victim system to mount an attacker-controlled NTFS filesystem (crafted image or removable media) using the in-kernel NTFS3 driver; the malicious attribute must declare empty mapping pairs with an inconsistent highest VCN and size to reach the vulnerable parsing path. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H = 9.8) substantially overstates real-world risk. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: upgrade to Linux 7.2.4 or 7.3-rc1 (or a distribution kernel that backports commits b0cc6dbc655e037251874b3e0dd1a760dcf29007 / 766062a82e1ce4087c7dc077224144dfd34b3661). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify systems running Linux kernels earlier than 7.2.4 that have NTFS3 support enabled. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today