EUVD-2026-76524
GHSA-v9qj-wpxr-47gc
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Reachable only by mounting a crafted NTFS volume, so AV:L and PR:L (mount capability); confirmed impact is OOB access most credibly causing a kernel crash, hence A:H with limited C/I.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
ntfs: reject invalid MFT LCNs from boot sector
The NTFS boot sector stores the MFT and MFTMirr locations as unsigned 64-bit LCNs, but parse_ntfs_boot_sector() decoded them into an s64.
A crafted high-bit value could therefore become negative and pass the existing upper-bound check. The invalid value then propagated into the MFT zone allocator and could result in an out-of-bounds access to lcn_empty_bits_per_page.
AnalysisAI
Out-of-bounds memory access in the Linux kernel ntfs3 filesystem driver occurs because parse_ntfs_boot_sector() decodes the boot sector's unsigned 64-bit MFT and MFTMirr Logical Cluster Numbers (LCNs) into a signed s64. A crafted NTFS image with a high-bit-set LCN wraps to a negative value that slips past the existing upper-bound check and propagates into the MFT zone allocator, driving an out-of-bounds access to lcn_empty_bits_per_page. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the target host to mount an attacker-controlled NTFS filesystem using the in-kernel ntfs3 driver, with a boot sector whose $MFT or $MFTMirr LCN has bit 63 set so it decodes to a negative s64. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The published CVSS 9.8 (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H) is materially overstated for this bug's real mechanics. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the kernel update that includes the fix: Vendor-released patch: 7.2.4 (also present in 7.3-rc1), or your distribution's backported stable-kernel build carrying commits 8f8420b6 and cc9d09fe. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, enumerate all systems running Linux kernel versions prior to 7.2.4 or 7.3-rc1 where the ntfs3 driver is enabled, and review administrative controls governing NTFS volume mounting across workstations and removable-media acceptance policies. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today