CVE-2026-72209

This CVE exposes a validation gap in the Linux NTFS driver's attribute lookup paths that allowed slab-out-of-bounds reads in kernel memory. The root cause is a duplicated blind spot: both `ntfs_attr_find()` and `ntfs_external_attr_find()` checked fixed-size record headers but failed to validate embedded length fields within variable-length resident attributes — specifically the `value_length` and `file_name_length` fields in `$FILE_NAME` attributes. When these fields are misaligned (permissibly per the NTFS spec but unhandled by the driver), the conversion functions `ntfs_ucstonls()` and `utf16s_to_utf8s()` trust the length values without bounds checking against each other, triggering the KASAN-detected read overflow. The fix centralizes validation logic rather than patching both locations independently, which is the correct architectural response but reveals something important: duplicated validation logic creates identical blind spots that persist until someone examines both paths simultaneously. This is a systemic pattern in kernel filesystem code, not an isolated NTFS failure. The fix also corrects a semantic bug where the old code overwrote actual value lengths with type-specific minimums before comparison — breaking correct behavior while failing to catch incorrect behavior. Additionally, the fix explicitly rejects non-resident `$FILE_NAME` records, which the spec permits but the driver's call chain assumes against. This hardens the driver against its own callers rather than fixing caller assumptions, which is pragmatically right but reveals how deeply residency assumptions were baked into the control flow without interface enforcement. For defenders: prioritize this patch. The kernel NTFS driver ships across Android, servers, embedded systems, and desktop Linux distributions. A kernel memory read primitive at arbitrary offsets is a privilege escalation enabler depending on heap layout. Beyond patching, audit any downstream consumers of NTFS attribute values that may have assumed the old broken validation semantics — the `AT_UNUSED` enumeration path that inspects returned attributes directly was explicitly included in the shared validator, indicating the original threat model was too narrow. Finally, treat this as a canary: if your codebase has parallel lookup paths with duplicated validation logic, the blind spots likely match. The KASAN catch tells us the tooling existed to find this; the organizational trigger did not.

Reviewed through automated stages and approved by a human before publication.