CVE-2026-72197

In the Linux kernel, the following vulnerability has been resolved:

fs/ntfs3: bound DeleteIndexEntryAllocation memmove length

In do_action()'s DeleteIndexEntryAllocation case, e->size comes

from an on-disk INDEX_BUFFER entry. When e->size makes

e + e->size point past hdr + hdr->used,

PtrOffset(e1, Add2Ptr(hdr, used)) returns a negative ptrdiff_t

that is silently cast to a quasi-infinite size_t when passed

to memmove(). The memmove then walks past the destination

buffer.

The sibling DeleteIndexEntryRoot case at fslog.c:3540-3543

already carries the corresponding guard:

if (PtrOffset(e1, Add2Ptr(hdr, used)) < esize ||

Add2Ptr(e, esize) > Add2Ptr(lrh, rec_len) ||

used + esize > le32_to_cpu(hdr->total)) {

goto dirty_vol;

}

Apply the same shape to the allocation-path case. Also reject

esize == 0: memmove(e, e, ...) is a no-op and leaves

hdr->used unchanged, hiding a malformed entry from the

existing check_index_header() walk.

Reproduced under UML+KASAN on mainline 8d90b09e6741 by

mounting a crafted NTFS image: the unguarded memmove takes a

length of 0xffffffffffffff00 and the kernel oopses in

memmove+0x81/0x1a0 on the do_action+0x36a2 frame.

[[email protected]: clang-formatted the changes]