Description
In the Linux kernel through 6.2.7, fs/ntfs3/inode.c has an invalid kfree because it does not validate MFT flags before replaying logs.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | linux | 6.3.7-1 | — |
| Debian 13 | linux | 6.3.7-1 | — |
| Debian 12 | linux | 6.1.37-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Nvidia-BlueField 22.04 LTS | linux-bluefield | 5.15.0-1023.25 | — |
| Ubuntu 24.04 LTS | linux-raspi-realtime | No fix yet | — |
| Ubuntu 22.04 LTS | linux +1 | 5.15.0-83.92 | USN-6339-1 |
| Ubuntu 22.04 LTS | linux-aws | 5.15.0-1044.49 | USN-6350-1 |
| Ubuntu 22.04 LTS | linux-aws-6.2 | 6.2.0-1013.13~22.04.1 | USN-6412-1 |
| Ubuntu 22.04 LTS | linux-azure | 5.15.0-1046.53 | USN-6339-3 |
| Ubuntu 22.04 LTS | linux-azure-6.2 +1 | 6.2.0-1014.14~22.04.1 | USN-6412-1 |
| Ubuntu 22.04 LTS | linux-azure-fde | 5.15.0-1046.53.1 | USN-6339-3 |
| Ubuntu 22.04 LTS | linux-azure-fde-6.2 | 6.2.0-1014.14~22.04.1.1 | USN-6412-1 |
| Ubuntu 22.04 LTS | linux-gcp | 5.15.0-1041.49 | USN-6339-1 |
| Ubuntu 22.04 LTS | linux-gcp-6.2 | 6.2.0-1016.18~22.04.1 | USN-6412-1 |
| Ubuntu 22.04 LTS | linux-gke +1 | 5.15.0-1041.46 | USN-6351-1, USN-6339-1 |
| Ubuntu 22.04 LTS | linux-gkeop | 5.15.0-1027.32 | USN-6351-1 |
| Ubuntu 22.04 LTS | linux-hwe-6.2 | 6.2.0-34.34~22.04.1 | USN-6412-1 |
| Ubuntu 22.04 LTS | linux-ibm +1 | 5.15.0-1037.40 | USN-6339-3, USN-6339-1 |
| Ubuntu 22.04 LTS | linux-intel-iotg | 5.15.0-1039.45 | USN-6339-4 |
| Ubuntu 22.04 LTS | linux-nvidia | 5.15.0-1032.32 | USN-6339-1 |
| Ubuntu 22.04 LTS | linux-nvidia-6.2 | 6.2.0-1011.11 | USN-6466-1 |
| Ubuntu 22.04 LTS | linux-nvidia-tegra | 5.15.0-1017.17 | — |
| Ubuntu 22.04 LTS | linux-nvidia-tegra-igx | 5.15.0-1004.4 | — |
| Ubuntu 22.04 LTS | linux-oem-6.1 | 6.1.0-1016.16 | — |
| Ubuntu 22.04 LTS | linux-oracle | 5.15.0-1042.48 | USN-6350-1 |
| Ubuntu 22.04 LTS | linux-riscv +12 | No fix yet | — |
| Ubuntu 22.04 LTS | linux-xilinx-zynqmp | 5.15.0-1025.29 | — |
| Ubuntu 20.04 LTS | linux-aws-5.15 | 5.15.0-1044.49~20.04.1 | USN-6350-1 |
| Ubuntu 20.04 LTS | linux-azure-5.15 | 5.15.0-1046.53~20.04.1 | USN-6339-3 |
| Ubuntu 20.04 LTS | linux-azure-fde-5.15 | 5.15.0-1046.53~20.04.1.1 | USN-6339-3 |
| Ubuntu 20.04 LTS | linux-gcp-5.15 | 5.15.0-1041.49~20.04.1 | USN-6339-2 |
| Ubuntu 20.04 LTS | linux-gkeop-5.15 | 5.15.0-1027.32~20.04.1 | USN-6339-2 |
| Ubuntu 20.04 LTS | linux-hwe-5.15 +1 | 5.15.0-83.92~20.04.1 | USN-6339-1 |
| Ubuntu 20.04 LTS | linux-ibm-5.15 | 5.15.0-1037.40~20.04.1 | USN-6350-1 |
| Ubuntu 20.04 LTS | linux-intel-iotg-5.15 | 5.15.0-1040.46~20.04.1 | — |
| Ubuntu 20.04 LTS | linux-nvidia-tegra-5.15 | 5.15.0-1017.17~20.04.1 | — |
| Ubuntu 20.04 LTS | linux-oracle-5.15 | 5.15.0-1042.48~20.04.1 | USN-6350-1 |
| Ubuntu 20.04 LTS | linux-riscv +23 | No fix yet | — |
| Ubuntu 20.04 LTS | linux-riscv-5.15 | 5.15.0-1040.44~20.04.3 | — |
| Ubuntu 18.04 LTS | linux-gcp +13 | No fix yet | — |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 16.04 LTS | linux-hwe-edge | No fix yet | — |
| Ubuntu Pro Realtime 22.04 LTS | linux-intel-iot-realtime | 5.15.0-1038.40 | — |
| Ubuntu Pro Realtime 22.04 LTS | linux-realtime | 5.15.0-1045.50 | — |
| Ubuntu Pro FIPS-preview 22.04 LTS | linux-fips | No fix yet | — |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | kernel-livepatch-6.1.29-50.88 | 1.0-0.amzn2023 | ALAS2023-2023-211 |
| Amazon Linux 2023 | perf +12 | 6.1.29-50.88.amzn2023 | ALAS2023-2023-211 |
Advisories 10
- USN-6466-1 linux-nvidia-6.2 vulnerabilities Ubuntu Security Notices (USN) · Nov 3, 2026
- USN-6412-1 linux, linux-aws, linux-aws-6.2, linux-azure, linux-azure-6.2, linux-azure-fde-6.2, linux-gcp, linux-gcp-6.2, linux-hwe-6.2, linux-kvm, linux-lowlatency, linux-lowlatency-hwe-6.2, linux-oracle, linux-raspi, linux-starfive vulnerabilities Ubuntu Security Notices (USN) · Oct 23, 2026
- USN-6339-1 linux, linux-gcp, linux-hwe-5.15, linux-ibm, linux-kvm, linux-lowlatency, linux-lowlatency-hwe-5.15, linux-nvidia vulnerabilities Ubuntu Security Notices (USN) · Oct 22, 2026
- USN-6339-3 linux-azure, linux-azure-5.15, linux-azure-fde, linux-azure-fde-5.15, linux-raspi vulnerabilities Ubuntu Security Notices (USN) · Oct 22, 2026
- USN-6350-1 linux-aws, linux-aws-5.15, linux-ibm-5.15, linux-oracle, linux-oracle-5.15 vulnerabilities Ubuntu Security Notices (USN) · Oct 22, 2026
- USN-6351-1 linux-gke, linux-gkeop vulnerabilities Ubuntu Security Notices (USN) · Oct 22, 2026
- USN-6339-2 linux-gcp-5.15, linux-gkeop-5.15 vulnerabilities Ubuntu Security Notices (USN) · Oct 22, 2026
- USN-6339-4 linux-intel-iotg vulnerabilities Ubuntu Security Notices (USN) · Oct 22, 2026
- WID-SEC-2023-0680 Linux Kernel: Schwachstelle ermöglicht nicht spezifizierten Angriff BSI CERT-Bund (WID) · Jul 1, 2024
- ALAS2023-2023-211 Important: kernel security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Jun 12, 2023
References
- https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git/commit/fs/ntfs3?id=467333af2f7b95eeaa61a5b5369a80063cd971fd
- https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=467333af2f7b95eeaa61a5b5369a80063cd971fd
- https://security.netapp.com/advisory/ntap-20230413-0006/