https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 29 Sep 2026 07:24:45 +0000 https://vulnerability.circl.lu/vuln/cve-2026-89615 <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>fs/ntfs3: bound page_lcns[] index by the log record</p> <p>The copy_lcns loop and the redo shorten loop index page_lcns[] at j + i, where i runs up to the log record&#39;s lcns_follow. That count is checked only against the record&#39;s own length, not the target entry, so check_dp_table() (which validates the entry&#39;s lcns_follow) does not cover it: the copy_lcns entry may even be freshly allocated after that check, and find_dp() bounds j but not i. A crafted record thus overflows page_lcns[] of an otherwise valid entry.</p> <p>Add dp_range_ok() and reject, before each loop, any record whose run does not fit the entry. These are the only two page_lcns[] accesses indexed by the record rather than the entry, so together with the entry validation every access is now bounded.</p> <p>[almaz.alexandrovich@paragon-software.com: original patch contained changes to the problem already handled, applied partly]</p> <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>fs/ntfs3: bound page_lcns[] index by the log record</p> <p>The copy_lcns loop and the redo shorten loop index page_lcns[] at j + i, where i runs up to the log record&#39;s lcns_follow. That count is checked only against the record&#39;s own length, not the target entry, so check_dp_table() (which validates the entry&#39;s lcns_follow) does not cover it: the copy_lcns entry may even be freshly allocated after that check, and find_dp() bounds j but not i. A crafted record thus overflows page_lcns[] of an otherwise valid entry.</p> <p>Add dp_range_ok() and reject, before each loop, any record whose run does not fit the entry. These are the only two page_lcns[] accesses indexed by the record rather than the entry, so together with the entry validation every access is now bounded.</p> <p>[almaz.alexandrovich@paragon-software.com: original patch contained changes to the problem already handled, applied partly]</p> https://vulnerability.circl.lu/vuln/cve-2026-89615