CVE-2026-46072: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-46072 Overview

CVE-2026-46072 is an out-of-bounds heap read vulnerability in the Linux kernel's ntfs3 filesystem driver. The flaw resides in the run_unpack() function, which parses run-length data from NTFS Master File Table (MFT) attributes. The function validates run_buf < run_last at the loop entry but fails to verify that size_size and offset_size bytes fit within the remaining buffer before reading them via run_unpack_s64(). A crafted NTFS image with truncated run data triggers an out-of-bounds heap read of up to 15 bytes during mount. The issue was discovered through fuzzing with a source-patched harness using LibAFL and QEMU.

Critical Impact
Mounting a malicious NTFS image causes a kernel-mode out-of-bounds heap read, potentially leaking kernel memory contents or causing instability.

Affected Products

Linux kernel ntfs3 filesystem driver
Systems mounting untrusted NTFS images or removable media
Distributions shipping affected upstream kernel versions prior to the fix

Discovery Timeline

2026-05-27 - CVE-2026-46072 published to NVD
2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-46072

Vulnerability Analysis

The ntfs3 driver parses NTFS run lists, which describe how file data extents map to disk clusters. The run_unpack() function iterates through packed run data within an MFT attribute. Each run entry begins with a header byte encoding size_size (the length of the size field) and offset_size (the length of the offset field). The function then calls run_unpack_s64() to decode these variable-length signed integers from the buffer.

The pre-patch implementation checked only that run_buf < run_last before reading the header byte. It did not validate that size_size + offset_size bytes remained available in the buffer before the subsequent decode operations. When attacker-controlled run data declared field lengths exceeding the remaining buffer, the driver read beyond the heap allocation by as many as 15 bytes.

Root Cause

The root cause is a missing boundary check classified as [CWE-125] Out-of-Bounds Read. The loop condition guarded only the starting pointer, not the cumulative consumption of bytes inside each iteration. The fix adds explicit checks before each run_unpack_s64() invocation to confirm the declared field size does not exceed run_last - run_buf.

Attack Vector

An attacker supplies a malformed NTFS image, typically via removable media, a loopback-mounted file, or an automounter triggered by user session activity. When the kernel mounts the image, run_unpack() processes the crafted MFT attribute and reads beyond the heap buffer. The out-of-bounds data may be incorporated into subsequent runlist calculations, potentially exposing adjacent heap memory or producing crashes.

The vulnerability mechanism is described in the upstream commit logs. See the Linux kernel patch commit for the corrective boundary-check implementation.

Detection Methods for CVE-2026-46072

Indicators of Compromise

Unexpected mount of NTFS volumes from removable media or untrusted image files
Kernel log entries from ntfs3 reporting malformed runlist data or KASAN out-of-bounds read warnings
Process activity invoking mount or udisksd against attacker-supplied .img, .vhd, or USB-backed devices

Detection Strategies

Enable Kernel Address Sanitizer (KASAN) on test kernels to surface out-of-bounds reads in run_unpack() and run_unpack_s64()
Audit dmesg and journalctl -k for ntfs3 parsing errors correlated with mount events
Inventory kernel versions across Linux fleets to identify hosts running affected ntfs3 builds

Monitoring Recommendations

Log all filesystem mount syscalls with the source device, filesystem type, and invoking user identity
Alert on mounts of ntfs3 volumes from non-standard paths such as /tmp, /home, or user-writable directories
Track udev and automount activity for USB-attached NTFS media in environments where this is not expected

How to Mitigate CVE-2026-46072

Immediate Actions Required

Apply upstream Linux kernel updates that include the ntfs3 boundary-check patches and reboot affected systems
Restrict mounting of untrusted NTFS images to administrators and disable automount for removable media on servers
Prefer the legacy read-only ntfs driver or FUSE-based ntfs-3g in environments where the in-kernel ntfs3 driver is not required

Patch Information

Fixes are available in the stable Linux kernel tree. The corrective commits are referenced in the NVD entry and include commit 41aadf5c, commit b62567bc, commit bf7ac4a1, commit d3012690, and commit e64f7dfc. Backports are available across multiple stable branches.

Workarounds

Blacklist the ntfs3 kernel module on systems that do not require NTFS read/write support
Disable desktop session automounting of removable media via udisks or polkit policies
Enforce mount restrictions in /etc/fstab and require explicit administrative action for NTFS image mounts

bash

# Blacklist the ntfs3 module until patched kernels are deployed
echo 'blacklist ntfs3' | sudo tee /etc/modprobe.d/blacklist-ntfs3.conf
sudo update-initramfs -u