CVE-2026-72197

In the Linux kernel, the following vulnerability has been resolved:

fs/ntfs3: bound DeleteIndexEntryAllocation memmove length

In doaction()'s DeleteIndexEntryAllocation case, e->size comes from an on-disk INDEXBUFFER entry. When e->size makes e + e->size point past hdr + hdr->used, PtrOffset(e1, Add2Ptr(hdr, used)) returns a negative ptrdifft that is silently cast to a quasi-infinite sizet when passed to memmove(). The memmove then walks past the destination buffer.

The sibling DeleteIndexEntryRoot case at fslog.c:3540-3543 already carries the corresponding guard:

if (PtrOffset(e1, Add2Ptr(hdr, used)) < esize ||
    Add2Ptr(e, esize) > Add2Ptr(lrh, rec_len) ||
    used + esize > le32_to_cpu(hdr->total)) {
    goto dirty_vol;
}

Apply the same shape to the allocation-path case. Also reject esize == 0: memmove(e, e, ...) is a no-op and leaves hdr->used unchanged, hiding a malformed entry from the existing checkindexheader() walk.

Reproduced under UML+KASAN on mainline 8d90b09e6741 by mounting a crafted NTFS image: the unguarded memmove takes a length of 0xffffffffffffff00 and the kernel oopses in memmove+0x81/0x1a0 on the do_action+0x36a2 frame.

[almaz.alexandrovich@paragon-software.com: clang-formatted the changes]