PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-46062 Linux CVE debrief

A vulnerability in the Linux kernel's ntfs3 filesystem driver has been resolved. The issue was an integer overflow in the `run_unpack()` function's volume boundary check. The original check `lcn + len > sbi->used.bitmap.nbits` used raw addition that could wrap around for large `lcn` and `len` values, allowing validation to be bypassed. The fix applies `check_add_overflow()`, consistent with adjacent overflow checks added in a prior commit (3ac37e100385). The vulnerability was discovered through fuzzing using LibAFL with QEMU. Multiple stable kernel branches have received patches.

Vendor
Linux
Product
Unknown
CVSS
Unknown
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-27
Original CVE updated
2026-05-27
Advisory published
2026-05-27
Advisory updated
2026-05-27

Who should care

Linux system administrators, kernel maintainers, and security teams managing systems that mount NTFS filesystems, particularly those handling untrusted or externally sourced NTFS volumes. Organizations with embedded Linux devices using ntfs3 should prioritize patching.

Technical summary

The ntfs3 filesystem driver in the Linux kernel contained an integer overflow vulnerability in the `run_unpack()` function. The volume boundary validation check used raw addition (`lcn + len > sbi->used.bitmap.nbits`) which could wrap around when processing NTFS runlists with large logical cluster number (lcn) and length (len) values. This wrap-around would cause the boundary check to incorrectly pass, potentially allowing out-of-bounds access. The resolution replaces the raw addition with `check_add_overflow()`, matching the defensive pattern already implemented for adjacent checks in the same function (prev_lcn + dlcn and vcn64 + len) from commit 3ac37e100385. Patches have been applied to multiple stable kernel branches.

Defensive priority

medium

Recommended defensive actions

  • Apply kernel updates from your Linux distribution when available for CVE-2026-46062
  • Verify ntfs3 module is not loaded on systems that do not require NTFS filesystem support
  • Monitor kernel stable branch announcements for backported fixes
  • Review systems that mount untrusted NTFS filesystems as higher priority for patching

Evidence notes

The vulnerability description indicates this was found through fuzzing with a source-patched harness (LibAFL + QEMU), suggesting active security research but no evidence of in-the-wild exploitation. The fix applies established overflow checking patterns already present in the same function.

Official resources

2026-05-27