{"id":"CVE-2026-45935","summary":"fs/ntfs3: Fix slab-out-of-bounds read in DeleteIndexEntryRoot","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nfs/ntfs3: Fix slab-out-of-bounds read in DeleteIndexEntryRoot\n\nIn the 'DeleteIndexEntryRoot' case of the 'do_action' function, the\nentry size ('esize') is retrieved from the log record without adequate\nbounds checking.\n\nSpecifically, the code calculates the end of the entry ('e2') using:\n    e2 = Add2Ptr(e1, esize);\n\nIt then calculates the size for memmove using 'PtrOffset(e2, ...)',\nwhich subtracts the end pointer from the buffer limit. If 'esize' is\nmaliciously large, 'e2' exceeds the used buffer size. This results in\na negative offset which, when cast to size_t for memmove, interprets\nas a massive unsigned integer, leading to a heap buffer overflow.\n\nThis commit adds a check to ensure that the entry size ('esize') strictly\nfits within the remaining used space of the index header before performing\nmemory operations.","modified":"2026-06-01T03:54:57.044098760Z","published":"2026-05-27T12:17:52.705Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/45xxx/CVE-2026-45935.json","cna_assigner":"Linux"},"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/36c03f7f177b34d51f1cf1d2304b1074607bf4b0"},{"type":"WEB","url":"https://git.kernel.org/stable/c/78942172d5bff4d4afed8674abc09cc560ce44a0"},{"type":"WEB","url":"https://git.kernel.org/stable/c/a584b9d1059b29e97e17c919274e9adfb846f2a0"},{"type":"WEB","url":"https://git.kernel.org/stable/c/b271c9cb85927210b1b799e55ee7f702d12b4336"},{"type":"WEB","url":"https://git.kernel.org/stable/c/b2bc7c44ed1779fc9eaab9a186db0f0d01439622"},{"type":"WEB","url":"https://git.kernel.org/stable/c/c065541b71b79874c83d418a9acd18ad5826339b"},{"type":"WEB","url":"https://git.kernel.org/stable/c/f3b437a4c3e022a1449658ae9f3dd34859894513"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/45xxx/CVE-2026-45935.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45935"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"b46acd6a6a627d876898e1c84d3f84902264b445"},{"fixed":"36c03f7f177b34d51f1cf1d2304b1074607bf4b0"},{"fixed":"b271c9cb85927210b1b799e55ee7f702d12b4336"},{"fixed":"a584b9d1059b29e97e17c919274e9adfb846f2a0"},{"fixed":"c065541b71b79874c83d418a9acd18ad5826339b"},{"fixed":"78942172d5bff4d4afed8674abc09cc560ce44a0"},{"fixed":"f3b437a4c3e022a1449658ae9f3dd34859894513"},{"fixed":"b2bc7c44ed1779fc9eaab9a186db0f0d01439622"}]}],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-45935.json"}},{"package":{"name":"Kernel","ecosystem":"Linux"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.15.0"},{"fixed":"5.15.202"}]},{"type":"ECOSYSTEM","events":[{"introduced":"5.16.0"},{"fixed":"6.1.165"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.2.0"},{"fixed":"6.6.128"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.7.0"},{"fixed":"6.12.75"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.13.0"},{"fixed":"6.18.14"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.19.0"},{"fixed":"6.19.4"}]}],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-45935.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}]}