PT-2026-43939 · Linux · Linux Kernel

CVE-2026-46072 · Published 2026-05-27 · Updated 2026-07-31

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description The run unpack() function in the ntfs3 driver fails to verify if the size size and offset size bytes read via run unpack s64() fit within the remaining buffer, despite checking run buf < run last at the start of the loop. A specially crafted NTFS image with truncated run data in an MFT attribute can trigger an out-of-bounds heap read of up to 15 bytes when the filesystem is mounted.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

CVE-2026-46072

ECHO-4F14-FA35-3665

OPENSUSE-SU-2026:10954-1

USN-8488-1

USN-8488-2

USN-8489-1

USN-8507-1

USN-8567-1

USN-8569-1

USN-8574-1

USN-8574-2

USN-8574-3

USN-8575-1

USN-8575-2

USN-8575-3

USN-8576-1

USN-8576-2

USN-8595-1

USN-8595-2

USN-8595-3

USN-8596-1

USN-8597-1

USN-8603-1

USN-8606-1

USN-8607-1

USN-8608-1

USN-8609-1

USN-8610-1

USN-8619-1

USN-8620-1

USN-8620-2

USN-8620-3

USN-8620-4

Affected Products

Linux Kernel

References · 2246

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/46xxx/CVE-2026-46072.json · Exploit
• https://ubuntu.com/security/CVE-2026-52916 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-43117 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-43371 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-64001 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-52959 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-31416 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-31580 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-46128 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-64129 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-46157 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-31576 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-45928 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-23361 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-43412 · Vendor Advisory