What is the CVSS score of EUVD-2026-59377?

EUVD-2026-59377 has a CVSS 3.1 base score of 8.4 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Linux Kernel are affected by EUVD-2026-59377?

Organizations using Linux systems to mount NTFS volumes face elevated risk of service disruption and potential kernel memory leaks from CVE-2026-72478, affecting Linux 6.1-7.0; no public exploit has…. A patch is available.

How to fix or mitigate EUVD-2026-59377?

Within 24 hours, audit all systems running Linux kernel versions 6.1.x through 7.0.x (verify via uname -r) and confirm whether ntfs3 driver is in use (check lsmod | grep ntfs3). Within 7 days, apply kernel security patches released by your Linux distribution or kernel.org for the affected series; validate patches in pre-production environments before production deployment. By day 30, complete patch rollout across all production infrastructure and conduct automated verification that no vulnerable kernel versions remain in active use.

Linux Kernel EUVD-2026-59377

| CVE-2026-72478 HIGH

2026-08-15 Linux

GHSA-pcrg-m6wx-53ch

Buffer Overflow Linux Red Hat Suse

8.4

CVSS 3.1 · Vendor: Linux

Severity by source

Vendor (Linux) PRIMARY

8.4 HIGH

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.7 HIGH

AV:L confirmed by mount-time-only trigger; PR:N for desktop auto-mount scenario; I:N because only a slab read primitive is demonstrated with no confirmed write escalation.

3.1 AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N

SUSE

5.5 MEDIUM

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Red Hat

5.5 MEDIUM

qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 17, 2026 - 09:46 vuln.today

CVSS changed

Aug 17, 2026 - 06:22 NVD

8.4 (HIGH)

Patch available

Aug 15, 2026 - 07:20 EUVD

CVE Published

Aug 15, 2026 - 05:57 cve.org

HIGH 8.4

CVE Published

Aug 15, 2026 - 05:57 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

fs/ntfs3: add bounds check to run_get_highest_vcn()

run_get_highest_vcn() parses a packed NTFS mapping-pairs buffer without any length bound, relying solely on a 0x00 terminator to stop. A crafted $LogFile UpdateMappingPairs record whose embedded attribute contains mapping-pairs runs without a terminator causes the function to read past the slab allocation, triggering a KASAN slab-out-of-bounds read on mount.

The sibling function run_unpack() received an analogous bounds-check in commit b62567bca474 ("ntfs3: add buffer boundary checks to run_unpack()"), but run_get_highest_vcn() was missed.

Take a run_buf_size parameter and reject any run header whose payload would extend past the buffer end, mirroring the pattern used by run_unpack(). The caller in fslog.c passes the remaining attribute bytes after the mapping-pairs offset.

KASAN report (on mainline v7.1 merge window HEAD):

BUG: KASAN: slab-out-of-bounds in run_get_highest_vcn+0x3c0/0x410 Read of size 1 at addr ffff88800e2d5400 by task mount/72 Call Trace: run_get_highest_vcn+0x3c0/0x410 do_action.isra.0+0x3ba8/0x7b50 log_replay+0x9ddd/0x10200 ntfs_loadlog_and_replay+0x4ad/0x610 ntfs_fill_super+0x214a/0x4540

AnalysisAI

Slab-out-of-bounds read in the Linux kernel ntfs3 filesystem driver exposes kernel heap memory and can cause a denial of service when a crafted NTFS volume is mounted. The flaw resides in run_get_highest_vcn(), which iterates over NTFS mapping-pairs buffers with no length bound, trusting a 0x00 terminator that a crafted $LogFile UpdateMappingPairs record can omit; the bug fires unconditionally during ntfs_fill_super on mount of the malicious image. Affected stable series span Linux 6.1.x through 7.0.x; the EPSS score is 0.18% (8th percentile) and the vulnerability is not listed in the CISA KEV catalog, indicating no confirmed active exploitation at time of analysis.

Technical ContextAI

The ntfs3 filesystem driver, merged into the mainline Linux kernel at version 5.15, handles NTFS volume mounting through ntfs_fill_super() in fs/ntfs3/super.c, which calls ntfs_loadlog_and_replay() → log_replay() → do_action() in fs/ntfs3/fslog.c. During log replay, do_action() invokes run_get_highest_vcn() in fs/ntfs3/run.c to scan the mapping-pairs buffer embedded in an UpdateMappingPairs attribute. Mapping-pairs are a compact binary format encoding virtual-cluster-number-to-logical-cluster-number extent mappings, terminated by a 0x00 header byte. The vulnerable function relied exclusively on that terminator to bound iteration, with no check against the remaining buffer length. This is structurally identical to the missing check previously patched in the sibling function run_unpack() via commit b62567bca474 ('ntfs3: add buffer boundary checks to run_unpack()'). The root cause is a missing buffer-length guard equivalent to CWE-125 (Out-of-bounds Read). CPE cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:* covers all affected kernel versions; KASAN confirms the read overrun at run_get_highest_vcn+0x3c0/0x410 during mount.

RemediationAI

Upgrade to the patched stable release for the running kernel series: 6.1.178, 6.6.145, 6.12.97, 6.18.40, 7.1.5, or 7.2-rc1. Upstream fix commits are available at https://git.kernel.org/stable/c/c69b9003332917b652175d5fa9d84158c5ed8617 (6.6 series), https://git.kernel.org/stable/c/8afc24a884aff6a6f08028bd779ee65c40054455 (7.x series), https://git.kernel.org/stable/c/c23083b472a720c3f60b147db05b25b751c7c1bf, https://git.kernel.org/stable/c/a31893206588374d7d16fad387189d8165c7efd3, https://git.kernel.org/stable/c/41081202eb823f5b27ff164b12010b24428100ad, and https://git.kernel.org/stable/c/bb11485a87fbb2254b62cfed630b699d50e57da8. For systems that cannot be immediately patched, blacklist the ntfs3 module by adding blacklist ntfs3 to /etc/modprobe.d/ntfs3-blacklist.conf and running modprobe -r ntfs3; this eliminates the attack surface entirely but prevents in-kernel NTFS mounting - the ntfs-3g FUSE driver remains available as an unaffected alternative with the trade-off of reduced performance. On desktop systems using udisks for auto-mount, configuring udisks2 ACL policy to block automatic NTFS mounts (/etc/polkit-1/rules.d/) reduces unauthenticated exploit exposure while preserving NTFS access for explicitly privileged operations.

Same technique Buffer Overflow

View all

CVE-2017-7269 CRITICAL POC

9.8

CVE-2015-5119 CRITICAL POC

9.8

CVE-2015-3113 CRITICAL POC

9.8

CVE-2011-2462 CRITICAL POC

9.8

CVE-2020-0796 CRITICAL POC

10.0

CVE-2019-11043 CRITICAL POC

9.8

CVE-2009-0927 HIGH POC

8.8

CVE-2012-1889 HIGH POC

8.8

Vendor StatusVendor

SUSE

Severity: Moderate

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 16.0	Not-Affected

EUVD-2026-59377 vulnerability details – vuln.today

Back

Linux Kernel EUVD-2026-59377

Severity by source

CVSS VectorVendor: Linux

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

Same technique Buffer Overflow

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code