Bug 2539858

Summary:	ntfs-3g: Multiple security vulnerabilities fixed in upstream 2026.9.18 release
Product:	[Fedora] Fedora EPEL	Reporter:	Akiyoshi Kurita <akito5623>
Component:	ntfs-3g	Assignee:	Tom "spot" Callaway <spotrh>
Status:	CLOSED ERRATA	QA Contact:	Fedora Extras Quality Assurance <extras-qa>
Severity:	unspecified	Docs Contact:
Priority:	unspecified
Version:	epel9	CC:	spotrh
Target Milestone:	---	Flags:	akito5623: needinfo? (spotrh)
Target Release:	---
Hardware:	Unspecified
OS:	Linux
Whiteboard:
Fixed In Version:	ntfs-3g-2022.10.3-13.el9	Doc Type:	---
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2026-10-08 00:30:35 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Akiyoshi Kurita 2026-09-24 01:46:07 UTC

Multiple security vulnerabilities in ntfs-3g were publicly disclosed by
upstream on the oss-security mailing list on September 23, 2026.

The issues are fixed in ntfs-3g 2026.9.18.

The disclosed vulnerabilities are:

- NTFS-3G-SA_2026-06-1_20:
  Heap buffer overflow in ntfs_acl_owner()
  CVSS: 6.2 (Moderate)

- NTFS-3G-SA_2026-06-1_19:
  Heap buffer overflow in ntfs_same_sid()
  CVSS: 6.8 (Moderate)

- NTFS-3G-SA_2026-06-1_12:
  Denial-of-service in ntfs_inode_attach_all_extents()
  CVSS: 6.2 (Moderate)

- NTFS-3G-SA_2026-06-1_11:
  Heap buffer overflow in ntfs_check_restart_area()
  CVSS: 2.9 (Low)

- NTFS-3G-SA_2026-06-1_10:
  Heap buffer overflow in ntfs_ea_check_wsldev()
  CVSS: 4.0 (Moderate)

- NTFS-3G-SA_2026-06-1_08:
  Heap buffer overflow in ntfs_external_attr_find()
  CVSS: 2.9 (Low)

- NTFS-3G-SA_2026-06-1_07:
  Heap data corruption in ntfs_mapping_pairs_decompress_i()
  CVSS: 2.9 (Low)

- NTFS-3G-SA_2026-06-1_05:
  Heap out-of-bounds read/write in ntfs_ie_add_vcn()
  CVSS: 6.2 (Moderate)

CVE IDs have been requested by upstream but have not yet been published.

EPEL 9 currently provides:

ntfs-3g-2022.10.3-10.el9

Upstream has provided a patch set specifically for the 2022.10.3 release,
so the fixes should be suitable for backporting to the EPEL 9 package.

References:

Upstream disclosure:
https://www.openwall.com/lists/oss-security/2026/09/23/4

Fixed release:
https://download.tuxera.com/opensource/ea5899b4ab87d243f6bed2f8fc13e6e5ff1f6d51fdf22b2ccbe708c8c0256166/ntfs-3g-2026.9.18.tar.gz

2022.10.3 security patch set:
https://download.tuxera.com/opensource/ea5899b4ab87d243f6bed2f8fc13e6e5ff1f6d51fdf22b2ccbe708c8c0256166/ntfs-3g_2022.10.3_SR_2026-09_patches.tar.gz


Please evaluate these vulnerabilities for Fedora EPEL, including EPEL 8,
EPEL 9 and EPEL 10 where applicable, and backport the upstream security
fixes as appropriate.

Comment 1 Akiyoshi Kurita 2026-09-24 03:02:21 UTC

Could you please review whether the current EPEL ntfs-3g packages are affected by these vulnerabilities?

Comment 2 Fedora Update System 2026-09-24 15:20:13 UTC

FEDORA-EPEL-2026-c518f1078d (ntfs-3g-2022.10.3-11.el9) has been submitted as an update to Fedora EPEL 9.
https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-c518f1078d

Comment 3 Fedora Update System 2026-09-25 00:45:30 UTC

FEDORA-EPEL-2026-c518f1078d has been pushed to the Fedora EPEL 9 testing repository.

You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-c518f1078d

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 4 Akiyoshi Kurita 2026-09-25 00:47:16 UTC

Thank you for preparing the EPEL 9 security update.

Could you also please apply the same upstream 2022.10.3 security patch set to the EPEL 10.2 package?

EPEL 10.2 currently uses the 2022.10.3 release as well, so the same security fixes should be applicable there.

Thank you.

Comment 5 Fedora Update System 2026-09-25 14:16:27 UTC

FEDORA-EPEL-2026-1843885c69 (ntfs-3g-2022.10.3-12.el9) has been submitted as an update to Fedora EPEL 9.
https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-1843885c69

Comment 6 Fedora Update System 2026-09-26 02:01:29 UTC

FEDORA-EPEL-2026-1843885c69 has been pushed to the Fedora EPEL 9 testing repository.

You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-1843885c69

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 7 Fedora Update System 2026-09-29 01:09:01 UTC

FEDORA-EPEL-2026-1843885c69 has been pushed to the Fedora EPEL 9 testing repository.

You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-1843885c69

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 8 Fedora Update System 2026-09-30 01:22:33 UTC

FEDORA-EPEL-2026-1843885c69 has been pushed to the Fedora EPEL 9 testing repository.

You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-1843885c69

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 9 Fedora Update System 2026-10-08 00:30:35 UTC

FEDORA-EPEL-2026-1843885c69 (ntfs-3g-2022.10.3-13.el9, ntfs-3g-system-compression-1.1-2.el9, and 2 more) has been pushed to the Fedora EPEL 9 stable repository.
If problem still persists, please make note of it in this bug report.