CVE-2026-46062

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-46062", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-05-13T15:03:33.095Z", "datePublished": "2026-05-27T12:57:24.416Z", "dateUpdated": "2026-08-05T12:29:26.689Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:29:26.689Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nntfs3: fix integer overflow in run_unpack() volume boundary check\n\nThe volume boundary check `lcn + len > sbi->used.bitmap.nbits` uses raw\naddition which can wrap around for large lcn and len values, bypassing\nthe validation. Use check_add_overflow() as is already done for the\nadjacent prev_lcn + dlcn and vcn64 + len checks added by commit\n3ac37e100385 (\"ntfs3: Fix integer overflow in run_unpack()\").\n\nFound by fuzzing with a source-patched harness (LibAFL + QEMU)."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerability is triggered by parsing a crafted NTFS data-run during mount/file access; NTFS3 is a local block-backed filesystem (not network-reachable), so the attacker supplies a malicious image/removable media that is mounted locally.\nAC:L - The integer overflow is deterministically controlled by the on-disk runlist values the attacker crafts; no race or attacker-uncontrollable condition is involved.\nPR:N - The attacker only needs to craft the malicious filesystem image and requires no privileges on the target; a victim with mount capability performs the mount (captured under UI).\nUI:R - Exploitation requires a victim to mount/access the attacker-supplied malicious NTFS volume (e.g., inserting removable media or mounting a provided image).\nS:U - The out-of-bounds access stays within the kernel's own security authority; there is no cross-boundary escape (no VM/IOMMU boundary crossed).\nC:H - The bypassed boundary check allows out-of-volume LCN ranges, enabling reads of arbitrary on-disk data bypassing access checks and out-of-bounds memory reads, per the sibling fix's own impact description.\nI:H - The same out-of-bounds cluster ranges permit destruction of arbitrary on-disk data and corruption of in-memory bitmap/free-space accounting, giving an attacker-controlled write primitive.\nA:H - Out-of-bounds cluster/bitmap access from a bypassed boundary check readily causes kernel oops/panic or filesystem corruption, denying service."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/ntfs3/run.c"], "versions": [{"version": "82cae269cfa953032fbb8980a7d554d60fb00b17", "lessThan": "424858f9a048057bb8f834bfe03d18f5e477e747", "status": "affected", "versionType": "git"}, {"version": "82cae269cfa953032fbb8980a7d554d60fb00b17", "lessThan": "e73cd5aed6b15e55c1c47577bdb473b5e88d6a69", "status": "affected", "versionType": "git"}, {"version": "82cae269cfa953032fbb8980a7d554d60fb00b17", "lessThan": "a954061b334ec67c79ae9d0cadd83fa521396487", "status": "affected", "versionType": "git"}, {"version": "82cae269cfa953032fbb8980a7d554d60fb00b17", "lessThan": "60dab3e2931f3d792438a77a6cb0cb731c43300b", "status": "affected", "versionType": "git"}, {"version": "82cae269cfa953032fbb8980a7d554d60fb00b17", "lessThan": "f1af27cec07a9fd0847166bdb23c99e86b05bfdc", "status": "affected", "versionType": "git"}, {"version": "82cae269cfa953032fbb8980a7d554d60fb00b17", "lessThan": "6175d09c23bec4b60860ee9a0170308ff4b56e10", "status": "affected", "versionType": "git"}, {"version": "82cae269cfa953032fbb8980a7d554d60fb00b17", "lessThan": "984a415f019536ea2d24de9010744e5302a9a948", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/ntfs3/run.c"], "versions": [{"version": "5.15", "status": "affected"}, {"version": "0", "lessThan": "5.15", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.209", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.175", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.140", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.86", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.27", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0.4", "lessThanOrEqual": "7.0.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "5.15.209"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "6.1.175"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "6.6.140"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "6.12.86"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "6.18.27"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "7.0.4"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "7.1"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/424858f9a048057bb8f834bfe03d18f5e477e747"}, {"url": "https://git.kernel.org/stable/c/e73cd5aed6b15e55c1c47577bdb473b5e88d6a69"}, {"url": "https://git.kernel.org/stable/c/a954061b334ec67c79ae9d0cadd83fa521396487"}, {"url": "https://git.kernel.org/stable/c/60dab3e2931f3d792438a77a6cb0cb731c43300b"}, {"url": "https://git.kernel.org/stable/c/f1af27cec07a9fd0847166bdb23c99e86b05bfdc"}, {"url": "https://git.kernel.org/stable/c/6175d09c23bec4b60860ee9a0170308ff4b56e10"}, {"url": "https://git.kernel.org/stable/c/984a415f019536ea2d24de9010744e5302a9a948"}], "title": "ntfs3: fix integer overflow in run_unpack() volume boundary check", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["fs/ntfs3/run.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "424858f9a048057bb8f834bfe03d18f5e477e747", "status": "affected", "version": "82cae269cfa953032fbb8980a7d554d60fb00b17", "versionType": "git"}, {"lessThan": "e73cd5aed6b15e55c1c47577bdb473b5e88d6a69", "status": "affected", "version": "82cae269cfa953032fbb8980a7d554d60fb00b17", "versionType": "git"}, {"lessThan": "a954061b334ec67c79ae9d0cadd83fa521396487", "status": "affected", "version": "82cae269cfa953032fbb8980a7d554d60fb00b17", "versionType": "git"}, {"lessThan": "60dab3e2931f3d792438a77a6cb0cb731c43300b", "status": "affected", "version": "82cae269cfa953032fbb8980a7d554d60fb00b17", "versionType": "git"}, {"lessThan": "f1af27cec07a9fd0847166bdb23c99e86b05bfdc", "status": "affected", "version": "82cae269cfa953032fbb8980a7d554d60fb00b17", "versionType": "git"}, {"lessThan": "6175d09c23bec4b60860ee9a0170308ff4b56e10", "status": "affected", "version": "82cae269cfa953032fbb8980a7d554d60fb00b17", "versionType": "git"}, {"lessThan": "984a415f019536ea2d24de9010744e5302a9a948", "status": "affected", "version": "82cae269cfa953032fbb8980a7d554d60fb00b17", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["fs/ntfs3/run.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.15"}, {"lessThan": "5.15", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.209", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.175", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.140", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.86", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.27", "versionType": "semver"}, {"lessThanOrEqual": "7.0.*", "status": "unaffected", "version": "7.0.4", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.1", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "6EDF0B07-5AB8-46F1-84C6-AAB5EF2C52B4", "versionEndExcluding": "5.15.209", "versionStartIncluding": "5.15", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "92385813-D91D-480D-83A1-F423D2CBB2BA", "versionEndExcluding": "6.1.175", "versionStartIncluding": "5.16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "A1A92866-F406-43B5-B2D1-CFC274753E9D", "versionEndExcluding": "6.6.140", "versionStartIncluding": "6.2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "55DA1C62-9991-451E-B8A8-E0004E00F789", "versionEndExcluding": "6.12.86", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "A10AC84F-C058-47D5-85B4-E6E51A613B74", "versionEndExcluding": "6.18.27", "versionStartIncluding": "6.13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "CDB78D6D-22C3-4154-B0D0-94AF1CE5C2E3", "versionEndExcluding": "7.0.4", "versionStartIncluding": "6.19", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nntfs3: fix integer overflow in run_unpack() volume boundary check\n\nThe volume boundary check `lcn + len > sbi->used.bitmap.nbits` uses raw\naddition which can wrap around for large lcn and len values, bypassing\nthe validation. Use check_add_overflow() as is already done for the\nadjacent prev_lcn + dlcn and vcn64 + len checks added by commit\n3ac37e100385 (\"ntfs3: Fix integer overflow in run_unpack()\").\n\nFound by fuzzing with a source-patched harness (LibAFL + QEMU)."}], "id": "CVE-2026-46062", "lastModified": "2026-06-17T10:53:00.270", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-05-27T14:17:26.063", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/424858f9a048057bb8f834bfe03d18f5e477e747"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/60dab3e2931f3d792438a77a6cb0cb731c43300b"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/6175d09c23bec4b60860ee9a0170308ff4b56e10"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/984a415f019536ea2d24de9010744e5302a9a948"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/a954061b334ec67c79ae9d0cadd83fa521396487"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/e73cd5aed6b15e55c1c47577bdb473b5e88d6a69"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/f1af27cec07a9fd0847166bdb23c99e86b05bfdc"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-190"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: ntfs3: fix integer overflow in run_unpack() volume boundary check", "id": "2482150", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2482150"}, "csaw": false, "cwe": "CWE-190", "details": ["A flaw was found in the Linux kernel's ntfs3 filesystem driver. An integer overflow vulnerability exists in the `run_unpack()` function's volume boundary check. This flaw occurs because the check uses raw addition, which can wrap around for large values, potentially bypassing validation. This could lead to system instability or data corruption."], "name": "CVE-2026-46062", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-05-27T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-46062\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-46062\nhttps://lore.kernel.org/linux-cve-announce/2026052756-CVE-2026-46062-35ef@gregkh/T"]}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[82cae269cfa953032fbb8980a7d554d60fb00b17,a954061b334ec67c79ae9d0cadd83fa521396487)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[82cae269cfa953032fbb8980a7d554d60fb00b17,60dab3e2931f3d792438a77a6cb0cb731c43300b)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[82cae269cfa953032fbb8980a7d554d60fb00b17,f1af27cec07a9fd0847166bdb23c99e86b05bfdc)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[82cae269cfa953032fbb8980a7d554d60fb00b17,6175d09c23bec4b60860ee9a0170308ff4b56e10)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[82cae269cfa953032fbb8980a7d554d60fb00b17,984a415f019536ea2d24de9010744e5302a9a948)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "5.15"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,5.15)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.140,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.86,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.27,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.0.4,7.1.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.1-rc1,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-05-27T20:15:16.212991+00:00", "updated": "2026-05-30T14:45:25.474400+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}