CVE-2026-72200

ntfs: detect mapping-pairs LCN accumulator overflow

State: Published
Severity: 9.8 Critical
Published: Aug 15, 2026
Updated: Oct 30, 2026
Reserved: Aug 9, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

ntfs: detect mapping-pairs LCN accumulator overflow

The NTFS mapping-pairs parser accumulates relative LCN deltas in a signed integer. A corrupted attribute can drive that addition past the representable range.

One corrupt runlist shape sets the accumulated LCN to S64_MAX and then adds a delta of 1 in the next mapping-pairs entry.

Signed overflow is undefined and can turn an invalid runlist into a different set of physical clusters.

Check the LCN addition for overflow before storing the next run.

Scores

CVSS	Score	Vector	Source
3.1	9.8 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before b06b4fc2138ded8ee0b3dc602991ff6dbb10dd0aAffected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 6626fb859f4c4772f2f59751d23937716e03f98fAffected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 7ffa8f3d30236e0ab897c30bdb01224ff1fe1c89Affected 1e9ea7e04472d4e5e12e58c881eaacfb3e49b669 to before 7fb64788812d137b37f6d8724e1e41c624c1e814Affected 1e9ea7e04472d4e5e12e58c881eaacfb3e49b669 to before ec4f061f2219e0f0c6465d56d0380bf749235a53Affected
LinuxLinux	2.6.12Affected 7.1Affected before 2.6.12Not affected 6.1.191 through 6.1.Not affected 6.6.160 through 6.6.Not affected 6.9 to before 7.1Not affected 7.1.5 through 7.1.*Not affected 7.2 and laterNot affected

Product

Versions

LinuxLinux

1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before b06b4fc2138ded8ee0b3dc602991ff6dbb10dd0aAffected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 6626fb859f4c4772f2f59751d23937716e03f98fAffected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 7ffa8f3d30236e0ab897c30bdb01224ff1fe1c89Affected
1e9ea7e04472d4e5e12e58c881eaacfb3e49b669 to before 7fb64788812d137b37f6d8724e1e41c624c1e814Affected
1e9ea7e04472d4e5e12e58c881eaacfb3e49b669 to before ec4f061f2219e0f0c6465d56d0380bf749235a53Affected

LinuxLinux

2.6.12Affected
7.1Affected
before 2.6.12Not affected
6.1.191 through 6.1.*Not affected
6.6.160 through 6.6.*Not affected
6.9 to before 7.1Not affected
7.1.5 through 7.1.*Not affected
7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.