Fedora Account System
Red Hat Associate
Red Hat Customer
https://www.openwall.com/lists/oss-security/2026/07/15/6 Summary: ntfs-3g: multiple memory safety vulnerabilities may affect EPEL 10 package Description: Multiple memory safety vulnerabilities were recently disclosed in ntfs-3g: CVE-2026-42616 CVE-2026-42617 CVE-2026-42618 CVE-2026-46569 CVE-2026-46570 CVE-2026-46571 CVE-2026-46572 CVE-2026-56135 CVE-2026-56136 Upstream report: https://www.openwall.com/lists/oss-security/2026/07/15/6 The current Fedora EPEL 10.2 package is based on ntfs-3g 2022.10.3: ntfs-3g 2:2022.10.3-9.el10_1 I also confirmed the following corresponding package in the AlmaLinux 10 x86_64_v2 EPEL rebuild repository: ntfs-3g.x86_64_v2 2:2022.10.3-9.el10_1.alma_altarch Upstream provides the following backport patch archive for ntfs-3g 2022.10.3: ntfs-3g_2022.10.3_cve_2026-04_patches.tar.gz Could you please confirm whether the current Fedora EPEL 10 package includes these fixes? If it is affected, could you please apply the upstream backport patches or update the package to a fixed release?
Could you please review whether the current EPEL ntfs-3g packages are affected by these vulnerabilities?
FEDORA-EPEL-2026-436cd95a7d (ntfs-3g-2026.7.7-2.el10_4) has been submitted as an update to Fedora EPEL 10.4. https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-436cd95a7d
FEDORA-EPEL-2026-436cd95a7d has been pushed to the Fedora EPEL 10.4 testing repository. You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-436cd95a7d See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.
Thank you for preparing the EPEL 10.4 update. Could you also please consider building ntfs-3g 2026.7.7 for the EPEL 10.2 branch? Since these vulnerabilities also affect older ntfs-3g versions, it would be helpful to have the security fixes available for EPEL 10.2 users as well. Thank you.
FEDORA-EPEL-2026-6769292d4a (ntfs-3g-2026.9.18-1.el10_4) has been submitted as an update to Fedora EPEL 10.4. https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-6769292d4a
I do not have the time to maintain builds for every different EPEL sub-revision. I would happily let someone else maintain those if they wish.
FEDORA-EPEL-2026-6769292d4a has been pushed to the Fedora EPEL 10.4 testing repository. You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-6769292d4a See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.