Skip to main content

Linux Kernel EUVDEUVD-2026-38891

| CVE-2026-53023 MEDIUM
2026-06-24 Linux GHSA-fw3c-7wwh-rhhf
Information Disclosure Linux Red Hat Suse
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
5.5 MEDIUM

Local filesystem mount access required (AV:L, PR:L); no confirmed confidentiality or integrity impact; kernel OOB read drives A:H with unchanged scope.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jul 15, 2026 - 14:08 vuln.today
CVSS changed
Jul 15, 2026 - 14:07 NVD
5.5 (MEDIUM)
Patch available
Jun 24, 2026 - 18:02 EUVD
CVE Published
Jun 24, 2026 - 16:29 nvd
MEDIUM 5.5
CVE Published
Jun 24, 2026 - 16:29 cve.org
UNKNOWN (no severity yet)

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

fs/ntfs3: terminate the cached volume label after UTF-8 conversion

ntfs_fill_super() loads the on-disk volume label with utf16s_to_utf8s() and stores the result in sbi->volume.label. The converted label is later exposed through ntfs3_label_show() using %s, but utf16s_to_utf8s() only returns the number of bytes written and does not add a trailing NUL.

If the converted label fills the entire fixed buffer, ntfs3_label_show() can read past the end of sbi->volume.label while looking for a terminator.

Terminate the cached label explicitly after a successful conversion and clamp the exact-full case to the last byte of the buffer.

AnalysisAI

Missing NUL termination in the Linux kernel's ntfs3 filesystem driver allows a local attacker with filesystem mount privileges to trigger an out-of-bounds memory read, crashing the kernel. The defect in ntfs_fill_super() leaves sbi->volume.label unterminated when a UTF-16 volume label converts to a UTF-8 string that exactly fills the fixed buffer, causing ntfs3_label_show() to read past the buffer boundary via a %s format specifier. No public exploit has been identified at time of analysis and EPSS sits at 0.17% (7th percentile), indicating very low current exploitation interest despite the High availability impact in CVSS.

Technical ContextAI

The vulnerability resides in fs/ntfs3/super.c within the Linux kernel's ntfs3 driver, introduced with the ntfs3 merge at commit 82cae269cfa9. During superblock initialization, ntfs_fill_super() converts the on-disk NTFS volume label from UTF-16LE to UTF-8 using the kernel helper utf16s_to_utf8s(), which returns the byte count written but does not NUL-terminate the destination. The result is stored in sbi->volume.label, a fixed-size char array. The sysfs callback ntfs3_label_show() later exposes this label using a %s format specifier, which reads memory until a NUL byte is found. When the converted label exactly fills the buffer - leaving no room for a terminator - the read continues past the allocated buffer into adjacent kernel memory. Although no CWE was formally assigned, the root cause is conceptually CWE-170 (Improper Null Termination). The affected CPE is cpe:2.3:a:linux:linux across multiple stable branches. The patch clamps the write to the last byte and explicitly NUL-terminates after conversion.

RemediationAI

The primary fix is to upgrade to a patched kernel version for your stable branch: 5.15.209, 6.1.175, 6.6.141, 6.12.91, 6.18.33, or 7.0.10. Upstream fix commits are available at https://git.kernel.org/stable/c/32b0686369e0afbb3549a0d93e2d8517da84cd30 and related branch-specific commits (bc7a0c34, 0b11fcbe, 54d564b7, 6136bbb0, 5cd0707b, a6cd43fe). Distribution maintainers for Debian, Ubuntu, RHEL, SUSE, and others are expected to backport these patches; consult your distribution's kernel security advisories. As a compensating control where immediate upgrade is not feasible, administrators can blacklist the ntfs3 module via /etc/modprobe.d/ (e.g., 'blacklist ntfs3'), preventing the driver from loading and eliminating the attack surface entirely - the trade-off is loss of all ntfs3 NTFS mount capability, requiring a fallback to the older ntfs driver or userspace ntfs-3g. On server systems where non-root users already lack mount privileges and no auto-mounting daemon is active, exploitation risk is already substantially contained without additional controls.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

EUVD-2026-38891 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy