CVE-2026-72196

CVE-2026-72196 is a heap write overflow in the NTFS3 driver's log_replay() function, specifically in the analysis path's copy_lcns block. This is the second out-of-bounds vulnerability in this function within weeks—both stem from the same root cause: insufficient bounds checking against dp->lcns_follow when indexing dp->page_lcns[]. The May 2026 fix addressed a memmove() bounds violation in the conversion path; today's fix addresses a parallel write overflow in the analysis path. Two complementary fixes on the same data structure isn't bad luck—it's a pattern indicating the dp->lcns_follow boundary wasn't treated as a security-critical invariant across all access points. The split-validation problem in find_dp() is the architectural failure. find_dp() validates that target_vcn falls within [dp->vcn, dp->vcn + dp->lcns_follow), then returns the DIR_PAGE_ENTRY to callers who must independently re-apply that invariant. Once a developer sees a

Reviewed through automated stages and approved by a human before publication.