Riskcovery

CVE-2026-43245

ntfs: ->d_compare() must not block

State
Published
Severity
7.5 High
Published
May 6, 2026
Updated
Aug 5, 2026
Reserved
May 1, 2026

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

ntfs: ->d_compare() must not block

... so don't use __getname() there. Switch it (and ntfs_d_hash(), while we are at it) to kmalloc(PATH_MAX, GFP_NOWAIT). Yes, ntfs_d_hash() almost certainly can do with smaller allocations, but let ntfs folks deal with that - keep the allocation size as-is for now.

Stop abusing names_cachep in ntfs, period - various uses of that thing in there have nothing to do with pathnames; just use k[mz]alloc() and be done with that. For now let's keep sizes as-in, but AFAICS none of the users actually want PATH_MAX.

Scores

CVSSScoreVectorSource
3.17.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HLinux

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • a3a956c78efaa202b1d75190136671cf6e87bfbe to before 02ecc0978c459fd90bb24b2a946dd16d43e68fe5Affected
  • a3a956c78efaa202b1d75190136671cf6e87bfbe to before 1be7ca86ce1794d966fda5d82181bc978b150fbcAffected
  • a3a956c78efaa202b1d75190136671cf6e87bfbe to before 142c444a395f4d26055c8a4473e228bb86283f1eAffected
  • a3a956c78efaa202b1d75190136671cf6e87bfbe to before fb4b1f969ba01fa1d4088467a02fc1e5f0806710Affected
  • a3a956c78efaa202b1d75190136671cf6e87bfbe to before ca2a04e84af79596e5cd9cfe697d5122ec39c8ceAffected
LinuxLinux
  • 6.2Affected
  • before 6.2Not affected
  • 6.6.141 through 6.6.*Not affected
  • 6.12.91 through 6.12.*Not affected
  • 6.18.16 through 6.18.*Not affected
  • 6.19.6 through 6.19.*Not affected
  • 7.0 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.