High 7.8Published May 27, 2026

CVE-2026-46062ntfs3: fix integer overflow in run_unpack() volume boundary check

Updated under an hour ago (Oct 27, 2026, 7:23 AM ET)

Does this affect you?

It affects Linux and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: ntfs3: fix integer overflow in run_unpack() volume boundary check The volume boundary check `lcn + len > sbi->used.bitmap.nbits` uses raw addition which can wrap around for large lcn and len values, bypassing the validation. Use check_add_overflow() as is already done for the adjacent prev_lcn + dlcn and vcn64 + len checks added by commit 3ac37e100385 ("ntfs3: Fix integer overflow in run_unpack()"). Found by fuzzing with a source-patched harness (LibAFL + QEMU).

CVSS: 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Analyzed
Record last updated: Aug 5, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 82cae269cfa953032fbb8980a7d554d60fb00b17 before 424858f9a048057bb8f834bfe03d18f5e477e747; from 82cae269cfa953032fbb8980a7d554d60fb00b17 before e73cd5aed6b15e55c1c47577bdb473b5e88d6a69; from 82cae269cfa953032fbb8980a7d554d60fb00b17 before a954061b334ec67c79ae9d0cadd83fa521396487; 82cae269cfa953032fbb8980a7d554d60fb00b17 builds before 60dab3e2931f3d792438a77a6cb0cb731c43300b; from 82cae269cfa953032fbb8980a7d554d60fb00b17 before f1af27cec07a9fd0847166bdb23c99e86b05bfdc; from 82cae269cfa953032fbb8980a7d554d60fb00b17 before 6175d09c23bec4b60860ee9a0170308ff4b56e10; from 82cae269cfa953032fbb8980a7d554d60fb00b17 before 984a415f019536ea2d24de9010744e5302a9a948	CNA record
linux linux_kernel linux:linux_kernel	from 5.15 before 5.15.209; from 5.16 before 6.1.175; from 6.2 before 6.6.140; from 6.7 before 6.12.86; from 6.13 before 6.18.27; from 6.19 before 7.0.4	NVD

References

References

https://git.kernel.org/stable/c/424858f9a048057bb8f834bfe03d18f5e477e747	patch
https://git.kernel.org/stable/c/e73cd5aed6b15e55c1c47577bdb473b5e88d6a69	patch
https://git.kernel.org/stable/c/a954061b334ec67c79ae9d0cadd83fa521396487	patch
https://git.kernel.org/stable/c/60dab3e2931f3d792438a77a6cb0cb731c43300b	patch
https://git.kernel.org/stable/c/f1af27cec07a9fd0847166bdb23c99e86b05bfdc	patch
https://git.kernel.org/stable/c/6175d09c23bec4b60860ee9a0170308ff4b56e10	patch
https://git.kernel.org/stable/c/984a415f019536ea2d24de9010744e5302a9a948	patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.