CVE-2026-72192 in Linux
Summary
by MITRE • 08/15/2026
In the Linux kernel, the following vulnerability has been resolved:
ntfs3: bound to_move in indx_insert_into_root before hdr_insert_head
indx_insert_into_root() promotes a full resident $INDEX_ROOT into $INDEX_ALLOCATION and copies all non-last resident root entries into a newly allocated INDEX_BUFFER via hdr_insert_head(). The source byte count 'to_move' is summed from the on-disk resident entry sizes and is independent of the destination buffer size, which comes from root->index_block_size (via indx->index_bits).
A crafted NTFS image that keeps a valid, full resident root but shrinks root->index_block_size down to 512 after the root has been populated makes hdr_insert_head() memcpy attacker-controlled resident entry bytes past the end of the kmalloc(1u << indx->index_bits) allocation returned by indx_new(). For a 512-byte destination and a resident root whose non-last entries total 560 bytes, the memcpy overruns by 120 bytes and a following memmove extends the highest written offset to 136 bytes past the allocation. The overflow bytes are a direct copy of on-disk entries (via kmemdup), so they are fully attacker-controlled.
The write is reachable from unprivileged open(O_CREAT) on a mounted crafted NTFS image: a single sufficiently long create in a directory whose resident root is already full forces root promotion and triggers the copy.
This is a controlled out-of-bounds write of 120-136 bytes past a kmalloc(index_block_size) allocation, with attacker-controlled content. It is a bounded adjacent-heap corruption primitive; it is not an arbitrary-address write. Successful exploitation into a named victim object depends on the surrounding slab layout.
Reject the copy at the sink. The destination's INDEX_HDR already reports hdr_total (the payload capacity of the new buffer) and hdr_used (the bytes already consumed by the terminal END entry installed by indx_new()); require that to_move fits in the remaining payload before calling hdr_insert_head(). On mismatch, fail with -EINVAL and mark the filesystem as having a detected on-disk inconsistency, which is the same behaviour as the surrounding validation in this function.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/15/2026
The vulnerability resides within the ntfs3 driver of the linux kernel, specifically in the indx_insert_into_root function where a controlled out-of-bounds memory write occurs during index root promotion. This flaw manifests when a crafted ntfs image contains a valid full resident index root but manipulates the root->index_block_size to a smaller value of 512 bytes after population. The core technical issue stems from how the source byte count 'to_move' is calculated based on on-disk entry sizes without proper validation against the destination buffer capacity derived from root->index_block_size through indx->index_bits.
The flaw creates a heap overflow condition when hdr_insert_head() performs a memcpy operation with attacker-controlled source data that extends beyond the allocated kmalloc buffer boundaries. The destination allocation size is determined by 1u << indx->index_bits while the source size calculation 'to_move' ignores this constraint and is based purely on disk entry dimensions. In a specific scenario where resident root entries total 560 bytes but the destination buffer is only 512 bytes, the memcpy overflows by 120 bytes, with subsequent memmove operations extending the valid write range to 136 bytes beyond allocation limits.
This vulnerability operates through an unprivileged open(O_CREAT) operation on a mounted crafted ntfs image where a single sufficiently long create operation in a directory with a full resident root triggers the problematic code path. The attacker-controlled data originates directly from on-disk entries via kmemdup operations, making it fully predictable and manipulable. The vulnerability represents a bounded adjacent-heap corruption primitive rather than arbitrary address write capability, requiring specific slab layout conditions for successful exploitation into named victim objects.
The exploitation pathway follows the ATT&CK technique T1059.007 for privilege escalation through kernel code execution, leveraging the ntfs3 driver as an attack surface. The flaw is categorized under CWE-787 Out-of-bounds Write in the CWE dictionary, specifically manifesting as a heap-based buffer overflow. The recommended fix implements validation at the destination sink by checking that to_move fits within the remaining payload capacity of the new buffer as reported by hdr_total and hdr_used fields in the INDEX_HDR structure. This defensive programming approach ensures that the copy operation fails gracefully with -EINVAL when size constraints are violated, while also marking the filesystem as having detected on-disk inconsistency similar to surrounding validation patterns within the same function, thereby preventing exploitation while maintaining system stability through consistent error handling practices.