CVE-2026-72185: ntfs: fix WARN_ON for resident attribute in ntfs_map_runlist_nolock()

CVE-2026-72185: ntfs: fix WARN_ON for resident attribute in ntfs_map_runlist_nolock()

[Greg Kroah-Hartman]

From: Greg Kroah-Hartman <gregkh@kernel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

ntfs: fix WARN_ON for resident attribute in ntfs_map_runlist_nolock()

When ntfs_map_runlist_nolock() needs to look up the attribute extent
containing a target VCN (ctx_needs_reset == true), it calls
ntfs_attr_lookup() and then expects the result to be a non-resident
attribute, since only non-resident attributes have a mapping pairs
array to decompress.

A crafted NTFS image can place a resident attribute where a non-resident
one is expected, causing ntfs_attr_lookup() to succeed but return a
resident attribute record.  Previously this was caught only by a
WARN_ON(), which does not stop execution.  The code then falls through to
read a->data.non_resident.highest_vcn from what is actually a resident
attribute, accessing the wrong union member and corrupting the VCN range
check.

The caller path triggering this warning during mount is:

  ntfs_map_runlist_nolock
  ntfs_empty_logfile
  load_system_files
  ntfs_fill_super

In this path ctx is NULL, so ntfs_map_runlist_nolock() allocates a
temporary search context internally and sets ctx_needs_reset = true.
The existing resident-attribute guard in the ctx != NULL branch already
returns -EIO silently for the same condition; make the ctx_needs_reset
path consistent by replacing the WARN_ON() with the same -EIO error
return.

This causes the crafted image to be rejected with a mount error instead
of triggering a kernel warning.

The Linux kernel CVE team has assigned CVE-2026-72185 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 7.1 with commit 495e90fa334828d4119061e2726af51d0a0fb4ed and fixed in 7.1.5 with commit b397b1238a217264bb02f963a1a1eadf71906375
	Issue introduced in 7.1 with commit 495e90fa334828d4119061e2726af51d0a0fb4ed and fixed in 7.2-rc3 with commit b8d6c528e9d57d263fee1a648409f84a68b2561d

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-72185
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	fs/ntfs/attrib.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/b397b1238a217264bb02f963a1a1eadf71906375
	https://git.kernel.org/stable/c/b8d6c528e9d57d263fee1a648409f84a68b2561d