CVE-2026-72192: ntfs3: bound to_move in indx_insert_into_root before hdr_insert_head

CVE-2026-72192: ntfs3: bound to_move in indx_insert_into_root before hdr_insert_head

[Greg Kroah-Hartman]

From: Greg Kroah-Hartman <gregkh@kernel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

ntfs3: bound to_move in indx_insert_into_root before hdr_insert_head

indx_insert_into_root() promotes a full resident $INDEX_ROOT into
$INDEX_ALLOCATION and copies all non-last resident root entries into
a newly allocated INDEX_BUFFER via hdr_insert_head(). The source
byte count 'to_move' is summed from the on-disk resident entry sizes
and is independent of the destination buffer size, which comes from
root->index_block_size (via indx->index_bits).

A crafted NTFS image that keeps a valid, full resident root but
shrinks root->index_block_size down to 512 after the root has been
populated makes hdr_insert_head() memcpy attacker-controlled resident
entry bytes past the end of the kmalloc(1u << indx->index_bits)
allocation returned by indx_new(). For a 512-byte destination and a
resident root whose non-last entries total 560 bytes, the memcpy
overruns by 120 bytes and a following memmove extends the highest
written offset to 136 bytes past the allocation. The overflow bytes
are a direct copy of on-disk entries (via kmemdup), so they are
fully attacker-controlled.

The write is reachable from unprivileged open(O_CREAT) on a mounted
crafted NTFS image: a single sufficiently long create in a directory
whose resident root is already full forces root promotion and
triggers the copy.

This is a controlled out-of-bounds write of 120-136 bytes past a
kmalloc(index_block_size) allocation, with attacker-controlled
content. It is a bounded adjacent-heap corruption primitive; it is
not an arbitrary-address write. Successful exploitation into a named
victim object depends on the surrounding slab layout.

Reject the copy at the sink. The destination's INDEX_HDR already
reports hdr_total (the payload capacity of the new buffer) and
hdr_used (the bytes already consumed by the terminal END entry
installed by indx_new()); require that to_move fits in the remaining
payload before calling hdr_insert_head(). On mismatch, fail with
-EINVAL and mark the filesystem as having a detected on-disk
inconsistency, which is the same behaviour as the surrounding
validation in this function.

The Linux kernel CVE team has assigned CVE-2026-72192 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 5.15 with commit 82cae269cfa953032fbb8980a7d554d60fb00b17 and fixed in 5.15.212 with commit 0af83b8155cc848e9f5d2c36e20a70d024214649
	Issue introduced in 5.15 with commit 82cae269cfa953032fbb8980a7d554d60fb00b17 and fixed in 6.1.178 with commit cb3161deebcaf8d36d3115abf452c633f2180fc1
	Issue introduced in 5.15 with commit 82cae269cfa953032fbb8980a7d554d60fb00b17 and fixed in 6.6.145 with commit 53c5f3b2da3774b41534728aba295c098c9efa19
	Issue introduced in 5.15 with commit 82cae269cfa953032fbb8980a7d554d60fb00b17 and fixed in 6.12.97 with commit 194b00c99ba971fa7cf6acd747a36032c6de54eb
	Issue introduced in 5.15 with commit 82cae269cfa953032fbb8980a7d554d60fb00b17 and fixed in 6.18.40 with commit aaa1f956c0fc41089a4a534da7df91552a08a47c
	Issue introduced in 5.15 with commit 82cae269cfa953032fbb8980a7d554d60fb00b17 and fixed in 7.1.5 with commit d240f5f9d036b8180224954d9873f172b6be4dd8
	Issue introduced in 5.15 with commit 82cae269cfa953032fbb8980a7d554d60fb00b17 and fixed in 7.2-rc1 with commit 9b6926ac9c970ae0b2c2fe6289b16e9aa10b6a67

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-72192
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	fs/ntfs3/index.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/0af83b8155cc848e9f5d2c36e20a70d024214649
	https://git.kernel.org/stable/c/cb3161deebcaf8d36d3115abf452c633f2180fc1
	https://git.kernel.org/stable/c/53c5f3b2da3774b41534728aba295c098c9efa19
	https://git.kernel.org/stable/c/194b00c99ba971fa7cf6acd747a36032c6de54eb
	https://git.kernel.org/stable/c/aaa1f956c0fc41089a4a534da7df91552a08a47c
	https://git.kernel.org/stable/c/d240f5f9d036b8180224954d9873f172b6be4dd8
	https://git.kernel.org/stable/c/9b6926ac9c970ae0b2c2fe6289b16e9aa10b6a67