CVE-2026-46062

ntfs3: fix integer overflow in run_unpack() volume boundary check

State: Published
Severity: 7.8 High
Published: May 27, 2026
Updated: Aug 5, 2026
Reserved: May 13, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

ntfs3: fix integer overflow in run_unpack() volume boundary check

The volume boundary check `lcn + len > sbi->used.bitmap.nbits` uses raw addition which can wrap around for large lcn and len values, bypassing the validation. Use check_add_overflow() as is already done for the adjacent prev_lcn + dlcn and vcn64 + len checks added by commit 3ac37e100385 ("ntfs3: Fix integer overflow in run_unpack()").

Found by fuzzing with a source-patched harness (LibAFL + QEMU).

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	82cae269cfa953032fbb8980a7d554d60fb00b17 to before 424858f9a048057bb8f834bfe03d18f5e477e747Affected 82cae269cfa953032fbb8980a7d554d60fb00b17 to before e73cd5aed6b15e55c1c47577bdb473b5e88d6a69Affected 82cae269cfa953032fbb8980a7d554d60fb00b17 to before a954061b334ec67c79ae9d0cadd83fa521396487Affected 82cae269cfa953032fbb8980a7d554d60fb00b17 to before 60dab3e2931f3d792438a77a6cb0cb731c43300bAffected 82cae269cfa953032fbb8980a7d554d60fb00b17 to before f1af27cec07a9fd0847166bdb23c99e86b05bfdcAffected 82cae269cfa953032fbb8980a7d554d60fb00b17 to before 6175d09c23bec4b60860ee9a0170308ff4b56e10Affected 82cae269cfa953032fbb8980a7d554d60fb00b17 to before 984a415f019536ea2d24de9010744e5302a9a948Affected
LinuxLinux	5.15Affected before 5.15Not affected 5.15.209 through 5.15.Not affected 6.1.175 through 6.1.Not affected 6.6.140 through 6.6.Not affected 6.12.86 through 6.12.Not affected 6.18.27 through 6.18.Not affected 7.0.4 through 7.0.Not affected 7.1 and laterNot affected

Product

Versions

LinuxLinux

82cae269cfa953032fbb8980a7d554d60fb00b17 to before 424858f9a048057bb8f834bfe03d18f5e477e747Affected
82cae269cfa953032fbb8980a7d554d60fb00b17 to before e73cd5aed6b15e55c1c47577bdb473b5e88d6a69Affected
82cae269cfa953032fbb8980a7d554d60fb00b17 to before a954061b334ec67c79ae9d0cadd83fa521396487Affected
82cae269cfa953032fbb8980a7d554d60fb00b17 to before 60dab3e2931f3d792438a77a6cb0cb731c43300bAffected
82cae269cfa953032fbb8980a7d554d60fb00b17 to before f1af27cec07a9fd0847166bdb23c99e86b05bfdcAffected
82cae269cfa953032fbb8980a7d554d60fb00b17 to before 6175d09c23bec4b60860ee9a0170308ff4b56e10Affected
82cae269cfa953032fbb8980a7d554d60fb00b17 to before 984a415f019536ea2d24de9010744e5302a9a948Affected

LinuxLinux

5.15Affected
before 5.15Not affected
5.15.209 through 5.15.*Not affected
6.1.175 through 6.1.*Not affected
6.6.140 through 6.6.*Not affected
6.12.86 through 6.12.*Not affected
6.18.27 through 6.18.*Not affected
7.0.4 through 7.0.*Not affected
7.1 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.