Security readout for executives and security teams
Plain-English summary
A flaw in Linux’s NTFS3 filesystem driver can let specially crafted filesystem data bypass a volume-boundary check because an integer calculation wraps around. Exploitation requires local interaction with NTFS content and user action, but the supplied CVSS assessment indicates potentially severe confidentiality, integrity, and availability impact.
Executive priority
Prioritize patching endpoints, analysis systems, and servers that handle removable or externally supplied NTFS content. Treat broad emergency action as context-dependent because exploitation requires local interaction and the sources show no active exploitation. Maintain normal expedited remediation for a high-severity kernel filesystem flaw.
Technical view
In ntfs3 run_unpack(), the expression lcn + len can overflow before comparison with the volume bitmap size, allowing invalid run data to evade validation. The kernel fix replaces raw addition with check_add_overflow(), consistent with nearby checks. The issue was found through LibAFL and QEMU fuzzing.
Likely exposure
Exposure centers on Linux systems using the NTFS3 driver to process untrusted or attacker-influenced NTFS volumes or images. The supplied record lists multiple affected kernel releases from 5.15 through 7.1, but its version data is irregular; confirm status using the relevant distribution or kernel stable branch.
Exploitation context
The CVSS vector is local, low complexity, requires no privileges, and requires user interaction. The source bundle marks the CVE as absent from KEV and provides no evidence of active exploitation or a public weaponized exploit. Discovery occurred through fuzzing with a source-patched harness.
Researcher notes
The security boundary failure is an unchecked unsigned addition in a volume-limit comparison. Review should focus on whether lcn plus len is rejected on overflow and whether downstream run processing becomes reachable. The supplied sources do not establish the precise resulting corruption primitive, practical exploitability, or affected distribution package versions.
Mitigation direction
- Update to a vendor-supported kernel containing the applicable referenced stable fix.
- Consult the Linux distribution’s advisory to map packaged kernel versions accurately.
- Restrict mounting or processing of untrusted NTFS media and filesystem images until patched.
- Where operationally feasible, disable unnecessary NTFS3 usage pending remediation.
Validation and detection
- Inventory systems that load or can load the ntfs3 kernel module.
- Record running kernel and distribution package versions on exposed systems.
- Confirm the installed kernel includes the applicable stable fix or vendor backport.
- Review workflows accepting removable media or externally supplied NTFS images.
- After updating, reboot and verify the patched kernel is running.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2026-46062 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H1.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/424858f9a048057bb8f834bfe03d18f5e477e747CVE reference, Linux
- https://git.kernel.org/stable/c/e73cd5aed6b15e55c1c47577bdb473b5e88d6a69CVE reference, Linux
- https://git.kernel.org/stable/c/a954061b334ec67c79ae9d0cadd83fa521396487CVE reference, Linux
- https://git.kernel.org/stable/c/60dab3e2931f3d792438a77a6cb0cb731c43300bCVE reference, Linux
- https://git.kernel.org/stable/c/f1af27cec07a9fd0847166bdb23c99e86b05bfdcCVE reference, Linux
- https://git.kernel.org/stable/c/6175d09c23bec4b60860ee9a0170308ff4b56e10CVE reference, Linux
- https://git.kernel.org/stable/c/984a415f019536ea2d24de9010744e5302a9a948CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.