Skip to main content

Linux Kernel EUVDEUVD-2026-86050

| CVE-2026-97437 HIGH
2026-09-24 Linux GHSA-fpf4-vw37-hxfh
Buffer Overflow Linux Red Hat Suse
7.1
CVSS 3.1 · Vendor: Linux
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Craft malicious NTFS image with oversized name_len
  2. Delivery
    Deliver via USB or disk image
  3. Exploit
    Victim mounts and lists directory
  4. Execution
    Bounds check bypassed in ntfs_dir_emit
  5. Persist
    OOB read in ntfs_utf16_to_nls
  6. Impact
    Kernel memory leak or crash

Vulnerability Assessment

Exploitation Conditions

Requires the victim to mount and read a directory on an attacker-crafted NTFS filesystem using the in-kernel ntfs3 driver - delivered via removable media (USB), a disk image file, or a mountable share. The specific trigger is an index entry with a small declared e->size but a large fname->name_len that bypasses the readdir-path bounds check. Limiting factors: mounting arbitrary filesystems normally requires CAP_SYS_ADMIN (root) or an auto-mount daemon such as udisks that mounts removable media on insertion; the attack is local-only (AV:L) and needs user interaction (UI:R) to insert media or open/list the image. Systems that disable ntfs3, block removable-media auto-mount, or restrict mount privileges are not realistically exposed.
Impact

The NVD/Linux CVSS of 7.1 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H) reflects a local, user-interaction-gated attack against the ntfs3 driver: an attacker crafts a malicious NTFS image whose index entry declares a small e->size but a large fname->name_len, bypassing the flawed bounds check in ntfs_dir_emit() and causing ntfs_utf16_to_nls() to read past the entry during readdir. There is no EPSS score, no CISA KEV listing, and no public POC provided, so no signal points to active or automated exploitation - this is a latent memory-safety bug, not a weaponized threat. The PR:N in the vector is generous: real exploitation requires the victim to mount and list a directory on an attacker-supplied filesystem, which on most systems needs CAP_SYS_ADMIN or an auto-mount daemon (udisks) triggered by physical USB insertion - the UI:R already captures part of this. The C:H rating is arguably overstated for an OOB read that is primarily crash-inducing; while the over-read filename bytes are emitted to userspace via readdir (a plausible bounded kernel-heap disclosure), the dominant outcome is a KASAN splat / oops (A:H). Bottom line: a genuine bug worth patching on multi-user or kiosk/removable-media systems, but low real-world priority absent auto-mount exposure - treat as routine kernel hygiene rather than an urgent fix.
Exploit ScenarioDerived

An attacker crafts a malicious NTFS filesystem image with an index entry containing a small declared e->size but an oversized name_len, then delivers it via USB stick, disk image, or network share that the victim mounts. When the victim (or an auto-mount daemon) lists a directory on the image, ntfs_utf16_to_nls() reads past the entry boundary, leaking adjacent kernel memory into the returned filename or crashing the kernel. No public exploit code is identified at time of analysis.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.1% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Sep 25, 2026

An out-of-bounds read exists in the Linux kernel's ntfs3 driver: the readdir path in ntfs_dir_emit() compares a UTF-16LE character count (fname->name_len) against a byte count (e->size) without accounting for the 2-byte encoding or the ATTR_FILE_NAME header, so a crafted NTFS image with a small declared entry size but a large name length slips past the bounds check and lets ntfs_utf16_to_nls() read beyond the index entry. Exploitation is local and requires the victim to mount and list a directory on the attacker-supplied filesystem, typically via removable media or a disk image opened by an auto-mount daemon, and mounting normally requires CAP_SYS_ADMIN or equivalent auto-mount privileges, with user interaction needed to insert the media or open the image. The impact is information disclosure (kernel memory contents adjacent to the entry) plus a denial-of-service crash; no public exploit code or active exploitation was identified at time of analysis, and no EPSS score was supplied, though patch code is already public in the upstream stable trees.

RemediationAI

Vendor-released patch: upgrade to Linux 6.12.111, 6.18.53, or 7.2 (or the corresponding stable commit from the references), which replaces the flawed length calculation in ntfs_dir_emit() with fname_full_size() and adds the key_size validation in hdr_find_e(); distribution kernels should be updated to a build that carries these fixes. Where immediate patching is not possible, the most effective compensating control is to stop the driver from ever touching untrusted images: blacklist or unload the ntfs3 module (for example via a modprobe blacklist entry plus removing any live mount), accepting the trade-off that NTFS volumes can no longer be mounted with the in-kernel driver - userspace ntfs-3g/FUSE can be used instead, which runs outside the kernel and does not share this bug. Additionally, disable automatic mounting of removable media and disk images by auto-mount services such as udisks, and restrict mount capability (CAP_SYS_ADMIN) to trusted administrators; this removes the usual delivery path for a crafted image but does not protect a privileged user who deliberately mounts a hostile filesystem. These mitigations reduce exposure but do not fix the underlying out-of-bounds read, so patching remains the primary remedy.

Affected VersionsENISA

Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <aa1bdbb39f49c5bc9779316891c40005517842a5
Linux patch: 6.12.111
Linux 0 <6.12.111
Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <6a8149a20e46086c756c2a9202e377c0b649a0c3
Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <ed6da1abeec50db9060d714f03743fe0b63e4fe4
Linux 0 <6.18.53
Linux patch: 7.2
Linux patch: 6.18.53

Affected Packages

euvd linux fix: 6.12.111, 6.18.53

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

NTFS stores directory contents as $I30 index entries built around the NTFS_DE structure, whose e->size field declares the byte length of the entry. Inside a FILE_NAME index entry, an ATTR_FILE_NAME structure of 66 bytes precedes the name field, which is stored as UTF-16LE and therefore consumes two bytes per character. The vulnerable readdir code in ntfs_dir_emit() used the check 'fname->name_len + sizeof(struct NTFS_DE) > le16_to_cpu(e->size)' - effectively name_len + 16 > e_size - which mixes a character count with a byte count and omits the 66-byte header entirely; the correct computation (16 + 66 + name_len * 2 > e_size) had already been implemented as the helper fname_full_size() in ntfs.h and used by cmp_fnames(), namei.c and fslog.c, but was not applied on the readdir path. Because the check underestimates the required space for multi-byte names, an attacker-controlled image can declare a small e->size alongside a large name_len so that ntfs_utf16_to_nls() walks past the entry boundary, which is the CWE-125 out-of-bounds read class. The same patch additionally validates key_size inside hdr_find_e() so a declared key_size cannot exceed available entry data, hardening the lookup/comparison path against the same boundary violation. The issue affects the in-kernel ntfs3 driver (CPE cpe:2.3:a:linux:linux), distinct from the legacy read-only ntfs driver and from the userspace ntfs-3g/FUSE implementation.

Know when the next one hits your stack

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (Linux) PRIMARY 7.1 HIGH
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H
vuln.today AI 5.6 MEDIUM

Local malicious-filesystem mount typically needs mount privilege (PR:L) and user action to insert/open media (UI:R); OOB read is crash-dominant (A:H) with only a bounded kernel-memory disclosure (C:L).

3.1 AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE 5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Red Hat 5.5 MEDIUM

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
High

Lifecycle Timeline

4
CVSS changed
Sep 25, 2026 - 05:23 NVD
7.1 (HIGH)
Patch available
Sep 24, 2026 - 17:03 EUVD
CVE Published
Sep 24, 2026 - 16:03 cve.org
HIGH 7.1
CVE Published
Sep 24, 2026 - 16:03 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

ntfs3: fix out-of-bounds read in ntfs_dir_emit() and hdr_find_e()

The bounds check in ntfs_dir_emit() compares fname->name_len (a character count) against e->size (a byte count) without accounting for the 2-byte-per-character UTF-16LE encoding or the ATTR_FILE_NAME header size:

if (fname->name_len + sizeof(struct NTFS_DE) > le16_to_cpu(e->size))

This computes: name_len + 16 > e_size

The correct check must account for the ATTR_FILE_NAME header (66 bytes before the name) and the UTF-16LE character size (2 bytes each):

sizeof(NTFS_DE) + offsetof(ATTR_FILE_NAME, name) + name_len * sizeof(short) > e_size

Which computes: 16 + 66 + name_len * 2 > e_size

The correct calculation already exists as fname_full_size() in ntfs.h and is used in cmp_fnames(), namei.c, and fslog.c, but was not used in the readdir path.

A crafted NTFS image with an index entry containing a small e->size but large fname->name_len bypasses the current check, causing ntfs_utf16_to_nls() to read past the entry boundary.

Additionally, add a key_size validation in hdr_find_e() to ensure the declared key_size does not exceed the available entry data, preventing comparison functions from reading past entry boundaries on the lookup path.

Executive ViewAI

Why It Matters

The Linux kernel's ntfs3 driver is affected by an out-of-bounds read vulnerability (CVE-2026-97437) that can disclose kernel memory or crash systems when a user mounts and lists a malicious NTFS filesystem, often from removable media or disk images. This requires local access and user interaction, but auto-mount daemons on systems handling untrusted media could be exploited, potentially leaking sensitive data or causing service disruptions. No public exploit code or active exploitation has been identified, and a vendor patch is available.

Business Impact: Medium
Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score
0.1%
Top 97% exploitable
Prevalence
High
ntfs3 ships in mainline Linux kernel; NTFS media handling common on desktops
Data Quality
4 sources
Confidence: Medium
EUVD NVD CVE.org EPSS Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.1%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Defer
Exploitation· derived
None
System Exposure· derived
Small
Automatable· derived
No
Human Impact
Medium

Priority Score

36
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +36
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-97437 ADVISORY https://vuldb.com/vuln/409548 REF https://git.kernel.org/stable/c/0505f1e7bb5b981b6ed62d98b26ddce76142865d REF https://git.kernel.org/stable/c/2f7d0ec8c10dc7bf7a8c9a9cb169f9a4d1fac2ba REF https://git.kernel.org/stable/c/6a8149a20e46086c756c2a9202e377c0b649a0c3 REF https://git.kernel.org/stable/c/aa1bdbb39f49c5bc9779316891c40005517842a5 REF https://git.kernel.org/stable/c/d1f98938e437732c0ecdfc8ee451e12a072f6d07 REF https://git.kernel.org/stable/c/ed6da1abeec50db9060d714f03743fe0b63e4fe4

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy