{"id":"CVE-2026-90118","revision":"e4bc8a23fefc44e4b1828e7d898546ff","records":[{"revision":"e4bc8a23fefc44e4b1828e7d898546ff","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-90118","aliases":[],"title":"ntfs: fix off-by-one page overflow in ntfs_decompress()","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nntfs: fix off-by-one page overflow in ntfs_decompress()\n\nThe per-token range check in ntfs_decompress() uses\n\n\tif (cb >= cb_sb_end || dp_addr > dp_sb_end)\n\t\tbreak;\n\nso dp_addr == dp_sb_end falls through to the symbol copy\n`*dp_addr++ = *cb++`, writing one byte past the destination page.  Since\nNTFS_SB_SIZE == PAGE_SIZE the destination is a single page, so the byte\nlands in the adjacent page, and *dest_ofs is left one past the sub-block\nend (the later `*dest_ofs &= ~PAGE_MASK` then yields 1, not 0, so the page\nis never finalized and later sub-blocks keep writing further past it).  A\ncorrupted compressed $DATA attribute thus produces a bounded run of\nout-of-bounds writes when the file is read.\n\nBreak as soon as dp_addr reaches dp_sb_end; a full sub-block still\ncompletes, as its final copy advances dp_addr to exactly dp_sb_end.","state":0,"publishedAt":"2026-09-17T16:06:23.333+00:00","modifiedAt":"2026-10-19T08:58:16.74+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"fs/ntfs/compress.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"1e9ea7e04472d4e5e12e58c881eaacfb3e49b669\",\n                            \"lessThan\": \"b42644e425fed4a5cd6c88372655da5c1b52c666\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"1e9ea7e04472d4e5e12e58c881eaacfb3e49b669\",\n                            \"lessThan\": \"98716c9fce21f6c8a9d71e08cf53e7504fa562f4\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"fs/ntfs/compress.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"7.1\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"7.1\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.2.6\",\n                            \"lessThanOrEqual\": \"7.2.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.3\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","score":7.8,"severity":"HIGH"}],"references":["https://git.kernel.org/stable/c/b42644e425fed4a5cd6c88372655da5c1b52c666","https://git.kernel.org/stable/c/98716c9fce21f6c8a9d71e08cf53e7504fa562f4"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-90118","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-90118","identifiers":["CVE-2026-90118"]},"retained":false,"historicalAffected":[]}],"coverage":[]}