CVE-2026-72210 in Linux
Summary
by MITRE • 08/15/2026
In the Linux kernel, the following vulnerability has been resolved:
ntfs: fix off-by-one in mapping pairs decoding bounds checks
In ntfs_mapping_pairs_decompress(), attr_end points one byte past the end of the attribute record:
attr_end = (u8 *)attr + le32_to_cpu(attr->length);
The two bounds checks validating that mapping pair data bytes fit within the attribute use strict greater-than (>), which allows a one-byte out-of-bounds read when the data extends exactly to attr_end:
b = *buf & 0xf; if (b) {
if (unlikely(buf + b > attr_end)) // off-by-one goto io_error; for (deltaxcn = (s8)buf[b--]; b; b--)
deltaxcn = (deltaxcn << 8) + buf[b];
}
When buf + b == attr_end, the check evaluates to false and buf[b] reads
one byte past the valid attribute boundary. The same pattern appears in the LCN delta bytes check.
Fix both checks to use >= so that buf[b] at exactly attr_end is
correctly rejected as out of bounds.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/15/2026
The vulnerability resides within the ntfs filesystem driver of the linux kernel, specifically in the ntfs_mapping_pairs_decompress function where improper bounds checking leads to an off-by-one error during mapping pairs decoding operations. This flaw manifests when processing attribute records containing mapping pair data that extends precisely to the boundary of the attribute record length. The issue stems from how the code calculates the end of the attribute record using attr_end = (u8 *)attr + le32_to_cpu(attr->length) which positions the pointer one byte beyond the actual attribute data. When validating that mapping pair data bytes fall within the attribute boundaries, the code employs strict greater-than comparisons instead of inclusive comparisons, creating a condition where a single byte read beyond the legitimate boundary can occur.
The technical implementation flaw occurs in two distinct validation checks within the same function where buffer pointer arithmetic is compared against the attribute end boundary. The first check examines whether the mapping pair data bytes fit within the attribute bounds using buf + b > attr_end which fails to account for the exact boundary condition, allowing one byte of out-of-bounds memory access when buf + b equals attr_end. This pattern also affects the LCN delta bytes validation, creating identical vulnerabilities in both locations. The vulnerability exploits the fact that when b represents the number of bytes to process, and buf + b reaches exactly attr_end, the comparison buf + b > attr_end returns false, enabling a read operation at buf[b] that accesses memory one byte beyond the valid attribute record boundary.
This vulnerability presents significant operational impact within linux systems utilizing ntfs filesystems, particularly in environments where untrusted or maliciously crafted ntfs volumes could be mounted. The out-of-bounds read creates potential for information disclosure, system instability, and could potentially enable privilege escalation attacks depending on the context of how the ntfs driver interacts with other kernel components. The flaw represents a classic buffer overrun condition that can lead to memory corruption and system crashes, affecting systems running kernel versions prior to the fix implementation. From a cybersecurity perspective, this vulnerability aligns with common attack patterns described in the attack tree framework under the ATT&CK technique T1059.007 for command and scripting interpreter and could be leveraged as part of broader exploitation chains targeting filesystem drivers.
The mitigation strategy requires modifying the comparison operators from strict greater-than to greater-than-or-equal comparisons, ensuring that buf[b] accesses at exactly attr_end are properly rejected as out-of-bounds operations. This fix directly addresses the root cause by correcting the bounds validation logic to account for the exact boundary condition where buffer pointers align with attribute record boundaries. The solution follows established security practices for preventing buffer overflows and aligns with common vulnerability remediation approaches detailed in industry standards such as those referenced in CWE-129, which covers improper validation of array indices. System administrators should implement this kernel update immediately across all systems that mount ntfs filesystems, particularly in enterprise environments where untrusted storage media might be encountered during routine operations, and the fix should be included in standard security patch management processes to prevent exploitation attempts targeting this specific vulnerability class.