In the Linux kernel, the following vulnerability has been resolved:
fs/ntfs3: Fix OOB read in indx_insert_into_buffer
Syzbot reported a OOB read bug:
BUG: KASAN: slab-out-of-bounds in indx_insert_into_buffer+0xaa3/0x13b0 fs/ntfs3/index.c:1755 Read of size 17168 at addr ffff8880255e06c0 by task syz-executor308/3630
Call Trace: <TASK> memmove+0x25/0x60 mm/kasan/shadow.c:54 indx_insert_into_buffer+0xaa3/0x13b0 fs/ntfs3/index.c:1755 indx_insert_entry+0x446/0x6b0 fs/ntfs3/index.c:1863 ntfs_create_inode+0x1d3f/0x35c0 fs/ntfs3/inode.c:1548 ntfs_create+0x3e/0x60 fs/ntfs3/namei.c:100 lookup_open fs/namei.c:3413 [inline]
If the member struct INDEX_BUFFER *index of struct indx_node is incorrect, that is, the value of __le32 used is greater than the value of __le32 total in struct INDEX_HDR. Therefore, OOB read occurs when memmove is called in indx_insert_into_buffer(). Fix this by adding a check in hdr_find_e().
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade kernel-toolsUpgrade bpftoolUpgrade kernel-debuginfo-common-aarch64Upgrade kernel-tools-develUpgrade kernel-tools-debuginfoUpgrade perfUpgrade perf-debuginfoUpgrade kernel-develUpgrade kernel-livepatch-5.15.117-72.142Upgrade python-perf-debuginfoUpgrade bpftool-debuginfoUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-debuginfoUpgrade kernel-headersUpgrade python-perfUpgrade kernel | May 20, 2026 | May 20, 2026 |
| Debian | — | Upgrade linux | Dec 29, 2025 | Dec 29, 2025 |
| Ubuntu | — | Upgrade linux-intel-iotgUpgrade linux-gcp-5.15Upgrade linux-intel-iotg-5.15Upgrade linux-realtimeUpgrade linux-oracle-5.15Upgrade linux-hwe-5.15Upgrade linux-riscv-5.15Upgrade linux-gcpUpgrade linux-nvidia-tegra-igxUpgrade linux-oracleUpgrade linux-ibmUpgrade linux-nvidiaUpgrade linux-xilinx-zynqmpUpgrade linux-azure-5.15Upgrade linux-gkeopUpgrade linux-azureUpgrade linux-kvmUpgrade linux-lowlatencyUpgrade linux-awsUpgrade linux-gkeUpgrade linux-nvidia-tegra-5.15Upgrade linux-raspiUpgrade linux-nvidia-tegraUpgrade linux-bluefieldUpgrade linuxUpgrade linux-lowlatency-hwe-5.15Upgrade linux-aws-5.15Upgrade linux-ibm-5.15Upgrade linux-intel-iot-realtime | Jan 6, 2026 | Dec 24, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub