{"apiVersion":"1.0","identifier":"CVE-2026-72210","description":"In the Linux kernel, the following vulnerability has been resolved: ntfs: fix off-by-one in mapping pairs decoding bounds checks In ntfs_mapping_pairs_decompress(), attr_end points one byte past the end of the attribute record: attr_end = (u8 *)attr + le32_to_cpu(attr->length); The two bounds checks validating that mapping pair data bytes fit within the attribute use strict greater-than (>), which allows a one-byte out-of-bounds read when the data extends exactly to attr_end: b = *buf & 0xf; if (b) { if (unlikely(buf + b > attr_end)) // off-by-one goto io_error; for (deltaxcn = (s8)buf[b--]; b; b--) deltaxcn = (deltaxcn << 8) + buf[b]; } When buf + b == attr_end, the check evaluates to false and buf[b] reads one byte past the valid attribute boundary. The same pattern appears in the LCN delta bytes check. Fix both checks to use >= so that buf[b] at exactly attr_end is correctly rejected as out of bounds.","publishedAt":"2026-08-15T06:21:39","lastModifiedAt":"2026-08-19T11:16:47","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-72210","cvssScore":9.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","epssProbability":0.00516,"riskScore":1.03,"affectedProduct":"linux","affectedVersions":"unknown","vulnerabilityType":"Kernel","operatingSystems":[],"links":{"self":"https://www.redsauce.net/api/cves/CVE-2026-72210","webPages":{"es":"https://www.redsauce.net/es/cves/CVE-2026-72210","en":"https://www.redsauce.net/en/cves/CVE-2026-72210","fr":"https://www.redsauce.net/fr/cves/CVE-2026-72210","pt":"https://www.redsauce.net/pt/cves/CVE-2026-72210","de":"https://www.redsauce.net/de/cves/CVE-2026-72210","sk":"https://www.redsauce.net/sk/cves/CVE-2026-72210","el":"https://www.redsauce.net/el/cves/CVE-2026-72210"},"source":"https://nvd.nist.gov/vuln/detail/CVE-2026-72210"}}