{
  "affected": [
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:12",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:13",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.100-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:14",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "7.1.5-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:  fs/ntfs3: resize log-\u003eone_page_buf when adopting on-disk page size  log_replay() allocates log-\u003eone_page_buf using the page size that was chosen from the host PAGE_SIZE:  \tlog-\u003eone_page_buf = kmalloc(log-\u003epage_size, GFP_NOFS);  Later, when a restart area is found, the log page size recorded on disk is adopted:  \tt32 = le32_to_cpu(log-\u003erst_info.r_page-\u003esys_page_size); \tif (log-\u003epage_size != t32) { \t\tlog-\u003el_size = log-\u003eorig_file_size; \t\tlog-\u003epage_size = norm_file_page(t32, \u0026log-\u003el_size, \t\t\t\t\t\tt32 == DefaultLogPageSize); \t}  If the on-disk page size is larger than the size used for the initial allocation, log-\u003epage_size grows but one_page_buf is left at its original, smaller size. A subsequent unaligned read_log_page() then reads log-\u003epage_size bytes into the undersized scratch buffer:  \tpage_buf = page_off ? log-\u003eone_page_buf : *buffer; \terr = ntfs_read_run_nb_ra(ni-\u003emi.sbi, \u0026ni-\u003efile.run, page_vbo, page_buf, \t\t\t\t  log-\u003epage_size, NULL, \u0026log-\u003eread_ahead);  overflowing the allocation. This is reachable when mounting a dirty NTFS volume whose log was formatted with a page size larger than the buffer initially allocated on the mounting host (for example a 64K-log volume mounted on a host that allocated a 4K scratch buffer).  Grow one_page_buf when the adopted on-disk page size exceeds the size used for the initial allocation. On krealloc() failure the original buffer is left intact and freed by the existing error path.",
  "id": "DEBIAN-CVE-2026-72470",
  "modified": "2026-09-14T16:47:38.167059964Z",
  "published": "2026-08-15T06:22:21.103Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://security-tracker.debian.org/tracker/CVE-2026-72470"
    }
  ],
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "upstream": [
    "CVE-2026-72470"
  ]
}