PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-45935 Linux CVE debrief

A slab-out-of-bounds read vulnerability exists in the Linux kernel's NTFS3 filesystem driver, specifically within the `DeleteIndexEntryRoot` case of the `do_action` function. The flaw stems from insufficient bounds validation when retrieving the entry size (`esize`) from a log record. When calculating the end of an entry pointer (`e2`) by adding `esize` to the entry start (`e1`), a maliciously large `esize` value causes `e2` to exceed the allocated buffer boundary. Subsequent `PtrOffset` calculations produce a negative offset that, when cast to `size_t` for `memmove` operations, wraps to a massive unsigned integer, resulting in heap buffer overflow conditions. The vulnerability was resolved by adding strict validation to ensure `esize` fits within the remaining used space of the index header before any memory operations are performed. This affects systems mounting NTFS filesystems using the kernel's native NTFS3 driver.

Vendor
Linux
Product
Unknown
CVSS
HIGH 7.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-27
Original CVE updated
2026-06-24
Advisory published
2026-05-27
Advisory updated
2026-06-24

Who should care

Linux system administrators managing NTFS filesystem mounts, security teams tracking kernel filesystem driver vulnerabilities, and organizations with mixed Windows/Linux environments using native NTFS3 driver support

Technical summary

The vulnerability resides in `fs/ntfs3` within the `DeleteIndexEntryRoot` handling path of the `do_action` function. The code retrieves `esize` (entry size) from NTFS log records without validating against the actual buffer bounds. The pointer arithmetic `e2 = Add2Ptr(e1, esize)` followed by `PtrOffset(e2, ...)` creates a signed-to-unsigned conversion vulnerability: when `esize` exceeds available space, the negative `PtrOffset` result becomes a very large `size_t` value passed to `memmove`, causing heap buffer overflow. The fix implements explicit bounds verification ensuring `esize` ≤ remaining index header space before pointer arithmetic operations.

Defensive priority

high

Recommended defensive actions

  • Apply kernel updates containing the referenced stable branch commits when available through distribution security channels
  • Restrict untrusted user access to NTFS filesystem mount operations until patching is complete
  • Monitor system logs for unexpected NTFS driver errors or kernel oops messages that may indicate exploitation attempts
  • Verify NTFS filesystem images from untrusted sources before mounting on unpatched systems

Evidence notes

Vulnerability description sourced from official CVE record and NVD entry published 2026-05-27. Patch commits referenced in source metadata confirm fix implementation across stable kernel branches. No KEV listing or known exploitation in the wild as of disclosure date.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-45935 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-45935

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-45935 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-45935

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/36c03f7f177b34d51f1cf1d2304b1074607bf4b0

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/78942172d5bff4d4afed8674abc09cc560ce44a0

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/a584b9d1059b29e97e17c919274e9adfb846f2a0

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/b271c9cb85927210b1b799e55ee7f702d12b4336

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/b2bc7c44ed1779fc9eaab9a186db0f0d01439622

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/c065541b71b79874c83d418a9acd18ad5826339b

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/f3b437a4c3e022a1449658ae9f3dd34859894513

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.