CVE-2026-97437 Linux CVE debrief

Who should care

Linux kernel developers, Linux distribution maintainers, and users of Linux-based systems should assess exposure and apply patches promptly. This includes anyone responsible for maintaining or securing Linux-based systems, especially those using the ntfs3 filesystem driver. Security teams and vulnerability management teams should also review and address this vulnerability to prevent potential exploitation.

Why it matters

A vulnerability in the Linux kernel's ntfs3 filesystem driver allows for an out-of-bounds read when processing directory entries in a crafted NTFS image. Linux kernel developers, Linux distribution maintainers, and users of Linux-based systems should assess exposure and apply patches promptly.

• Verify Linux kernel versions and apply patches to prevent potential out-of-bounds reads
• Monitor Linux kernel updates and apply patches promptly to prevent exploitation
• Assess exposure of Linux-based systems to this vulnerability

Technical summary

The vulnerability is caused by incorrect bounds checking in the `ntfs_dir_emit()` function and a missing validation in `hdr_find_e()`. This allows for an out-of-bounds read when processing directory entries in a crafted NTFS image. The `ntfs_dir_emit()` function compares `fname->name_len` (a character count) against `e->size` (a byte count) without accounting for the 2-byte-per-character UTF-16LE encoding or the ATTR_FILE_NAME header size. The correct check must account for the ATTR_FILE_NAME header (66 bytes before the name) and the UTF-16LE character size (2 bytes each).

Defensive priority

High

Recommended defensive actions

• Review and apply patches from the Linux kernel maintainers
• Update Linux kernel to a version that includes the fix
• Monitor Linux kernel updates and apply patches promptly
• Verify Linux kernel versions and apply patches to prevent potential out-of-bounds reads
• Assess exposure of Linux-based systems to this vulnerability
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its description and CVSS score. However, the corpus does not establish versions, exploitation, impact, or remediation, requiring verification from official sources.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.