Buffer Overflow Affecting kernel6.18-tools-devel package, versions <1:6.18.41-94.142.amzn2023
Threat Intelligence
The probability is the direct output of the EPSS model, and conveys an overall sense of the threat of exploitation in the wild. The percentile measures the EPSS probability relative to all known EPSS scores. Note: This data is updated daily, relying on the latest available EPSS model version. Check out the EPSS documentation for more details.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-AMZN2023-KERNEL618TOOLSDEVEL-19466306
- published1 Sept 2026
- disclosed15 Aug 2026
Introduced: 15 Aug 2026
NewCVE-2026-72192 (opens in a new tab)How to fix?
Upgrade Amazon-Linux:2023 kernel6.18-tools-devel to version 1:6.18.41-94.142.amzn2023 or higher.
This issue was patched in ALAS2023-2026-2071.
NVD Description
Note: Versions mentioned in the description apply only to the upstream kernel6.18-tools-devel package and not the kernel6.18-tools-devel package as distributed by Amazon-Linux.
See How to fix? for Amazon-Linux:2023 relevant fixed versions and status.
In the Linux kernel, the following vulnerability has been resolved:
ntfs3: bound to_move in indx_insert_into_root before hdr_insert_head
indx_insert_into_root() promotes a full resident $INDEX_ROOT into $INDEX_ALLOCATION and copies all non-last resident root entries into a newly allocated INDEX_BUFFER via hdr_insert_head(). The source byte count 'to_move' is summed from the on-disk resident entry sizes and is independent of the destination buffer size, which comes from root->index_block_size (via indx->index_bits).
A crafted NTFS image that keeps a valid, full resident root but shrinks root->index_block_size down to 512 after the root has been populated makes hdr_insert_head() memcpy attacker-controlled resident entry bytes past the end of the kmalloc(1u << indx->index_bits) allocation returned by indx_new(). For a 512-byte destination and a resident root whose non-last entries total 560 bytes, the memcpy overruns by 120 bytes and a following memmove extends the highest written offset to 136 bytes past the allocation. The overflow bytes are a direct copy of on-disk entries (via kmemdup), so they are fully attacker-controlled.
The write is reachable from unprivileged open(O_CREAT) on a mounted crafted NTFS image: a single sufficiently long create in a directory whose resident root is already full forces root promotion and triggers the copy.
This is a controlled out-of-bounds write of 120-136 bytes past a kmalloc(index_block_size) allocation, with attacker-controlled content. It is a bounded adjacent-heap corruption primitive; it is not an arbitrary-address write. Successful exploitation into a named victim object depends on the surrounding slab layout.
Reject the copy at the sink. The destination's INDEX_HDR already reports hdr_total (the payload capacity of the new buffer) and hdr_used (the bytes already consumed by the terminal END entry installed by indx_new()); require that to_move fits in the remaining payload before calling hdr_insert_head(). On mismatch, fail with -EINVAL and mark the filesystem as having a detected on-disk inconsistency, which is the same behaviour as the surrounding validation in this function.
References
- http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72192
- https://git.kernel.org/stable/c/0af83b8155cc848e9f5d2c36e20a70d024214649
- https://git.kernel.org/stable/c/194b00c99ba971fa7cf6acd747a36032c6de54eb
- https://git.kernel.org/stable/c/53c5f3b2da3774b41534728aba295c098c9efa19
- https://git.kernel.org/stable/c/9b6926ac9c970ae0b2c2fe6289b16e9aa10b6a67
- https://git.kernel.org/stable/c/aaa1f956c0fc41089a4a534da7df91552a08a47c
- https://git.kernel.org/stable/c/cb3161deebcaf8d36d3115abf452c633f2180fc1
- https://git.kernel.org/stable/c/d240f5f9d036b8180224954d9873f172b6be4dd8