Heimdall Security Logo

CVE-2026-72470

Vulnérabilité élevée dans Linux (Linux)

CVSS 7.8 · Élevée
EPSS 0.2%
Linux•Linux•Versions : 7.1.5, 6.18.40, <=6.12.*, b46acd6a6a627d876898e1c84d3f84902264b445, 0, <=7.1.*, 6.12.97, <=6.6.*, <c99444f6dfca893f6d310aae4a53c620f98f7b4f, <5.15, 5.15, <=6.18.*, 6.6.145, <f1422df595d69b997d23a8f11e12c528ccef7fad, <4f129fc6f756f8541e5bff45b1804cc11b1ec712, <=*, <2097a2537d9d1c29c0e20ed0dbf717a0ccd8f374, 7.2, <5a35454179fe1041d9cd286f5d320ce0d448c12a

Description

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: resize log->one_page_buf when adopting on-disk page size log_replay() allocates log->one_page_buf using the page size that was chosen from the host PAGE_SIZE: log->one_page_buf = kmalloc(log->page_size, GFP_NOFS); Later, when a restart area is found, the log page size recorded on disk is adopted: t32 = le32_to_cpu(log->rst_info.r_page->sys_page_size); if (log->page_size != t32) { log->l_size = log->orig_file_size; log->page_size = norm_file_page(t32, &log->l_size, t32 == DefaultLogPageSize); } If the on-disk page size is larger than the size used for the initial allocation, log->page_size grows but one_page_buf is left at its original, smaller size. A subsequent unaligned read_log_page() then reads log->page_size bytes into the undersized scratch buffer: page_buf = page_off ? log->one_page_buf : *buffer; err = ntfs_read_run_nb_ra(ni->mi.sbi, &ni->file.run, page_vbo, page_buf, log->page_size, NULL, &log->read_ahead); overflowing the allocation. This is reachable when mounting a dirty NTFS volume whose log was formatted with a page size larger than the buffer initially allocated on the mounting host (for example a 64K-log volume mounted on a host that allocated a 4K scratch buffer). Grow one_page_buf when the adopted on-disk page size exceeds the size used for the initial allocation. On krealloc() failure the original buffer is left intact and freed by the existing error path.

Gravité et risque d'exploitation

CVE-2026-72470 obtient un score CVSS de 7.8/10, soit une gravité élevée. Selon le modèle EPSS, la probabilité qu'elle soit exploitée dans les 30 prochains jours est de 0.18 %, ce qui la place devant 6.5 % des CVE référencées.

Que faire ?

  • Vérifiez si Linux (versions 7.1.5, 6.18.40, <=6.12.*, b46acd6a6a627d876898e1c84d3f84902264b445, 0, <=7.1.*, 6.12.97, <=6.6.*, <c99444f6dfca893f6d310aae4a53c620f98f7b4f, <5.15, 5.15, <=6.18.*, 6.6.145, <f1422df595d69b997d23a8f11e12c528ccef7fad, <4f129fc6f756f8541e5bff45b1804cc11b1ec712, <=*, <2097a2537d9d1c29c0e20ed0dbf717a0ccd8f374, 7.2, <5a35454179fe1041d9cd286f5d320ce0d448c12a) est présent sur votre parc.
  • Appliquez le correctif ou la version corrigée indiqués dans les références de l'éditeur.
  • À défaut de correctif, limitez l'exposition (filtrage réseau, désactivation du composant).
  • Automatisez la détection : les agents CVE Heimdall (gratuits, open source) corrèlent l'inventaire de vos serveurs avec la base CVE.

Références

Rechercher une autre CVE