CVE-2026-45935

Beschreibung

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Fix slab-out-of-bounds read in DeleteIndexEntryRoot In the -DeleteIndexEntryRoot- case of the -do_action- function, the entry size (-esize-) is retrieved from the log record without adequate bounds checking. Specifically, the code calculates the end of the entry (-e2-) using: e2 = Add2Ptr(e1, esize); It then calculates the size for memmove using -PtrOffset(e2, ...)-, which subtracts the end pointer from the buffer limit. If -esize- is maliciously large, -e2- exceeds the used buffer size. This results in a negative offset which, when cast to size_t for memmove, interprets as a massive unsigned integer, leading to a heap buffer overflow. This commit adds a check to ensure that the entry size (-esize-) strictly fits within the remaining used space of the index header before performing memory operations.