{
  "affected": [
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:12",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.1.180-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:13",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.100-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:14",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "7.1.5-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:  fs/ntfs3: bound copy_lcns dp-\u003epage_lcns[] index in analysis pass  In log_replay()'s analysis pass, after find_dp() returns a valid DIR_PAGE_ENTRY for the (target_attr, target_vcn) tuple, the copy_lcns block walks lrh-\u003elcns_follow further entries:  \tt16 = le16_to_cpu(lrh-\u003elcns_follow); \tfor (i = 0; i \u003c t16; i++) { \t    size_t j = (size_t)(le64_to_cpu(lrh-\u003etarget_vcn) - \t                        le64_to_cpu(dp-\u003evcn)); \t    dp-\u003epage_lcns[j + i] = lrh-\u003epage_lcns[i]; \t}  find_dp() only validates that target_vcn falls within [dp-\u003evcn, dp-\u003evcn + dp-\u003elcns_follow), i.e., that the FIRST cluster is covered.  The walk through the further entries is not bounded against dp-\u003elcns_follow.  For a malformed LRH where target_vcn = dp-\u003evcn + dp-\u003elcns_follow - 1 and lrh-\u003elcns_follow \u003e 1, the i \u003e 0 writes overflow the dp's allocated page_lcns[] array.  Add the missing j + lrh-\u003elcns_follow \u003c= dp-\u003elcns_follow guard.  Reproduced under UML+KASAN on mainline 8d90b09e6741 as a slab-out-of-bounds write of size 8 from log_replay+0x68d4 on the mount path.  This is distinct from Pavitra Jha's 2026-05-02 patch (\"fs/ntfs3: validate lcns_follow in log_replay conversion\", \u003c20260502154252.164586-1-jhapavitra98@gmail.com\u003e) which addresses the separate version-0 dirty-page-table conversion path's memmove(\u0026dp-\u003evcn, ...) call.  The two fixes are complementary; both should land.  [almaz.alexandrovich@paragon-software.com: clang-formatted the changes, fixed conflicts]",
  "id": "DEBIAN-CVE-2026-72196",
  "modified": "2026-09-14T16:47:33.735446611Z",
  "published": "2026-08-15T06:21:38.200Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://security-tracker.debian.org/tracker/CVE-2026-72196"
    }
  ],
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "upstream": [
    "CVE-2026-72196"
  ]
}