Fedora Account System
Red Hat Associate
Red Hat Customer
Multiple security vulnerabilities in ntfs-3g were publicly disclosed by upstream on the oss-security mailing list on September 23, 2026. The issues are fixed in ntfs-3g 2026.9.18. The disclosed vulnerabilities are: - NTFS-3G-SA_2026-06-1_20: Heap buffer overflow in ntfs_acl_owner() CVSS: 6.2 (Moderate) - NTFS-3G-SA_2026-06-1_19: Heap buffer overflow in ntfs_same_sid() CVSS: 6.8 (Moderate) - NTFS-3G-SA_2026-06-1_12: Denial-of-service in ntfs_inode_attach_all_extents() CVSS: 6.2 (Moderate) - NTFS-3G-SA_2026-06-1_11: Heap buffer overflow in ntfs_check_restart_area() CVSS: 2.9 (Low) - NTFS-3G-SA_2026-06-1_10: Heap buffer overflow in ntfs_ea_check_wsldev() CVSS: 4.0 (Moderate) - NTFS-3G-SA_2026-06-1_08: Heap buffer overflow in ntfs_external_attr_find() CVSS: 2.9 (Low) - NTFS-3G-SA_2026-06-1_07: Heap data corruption in ntfs_mapping_pairs_decompress_i() CVSS: 2.9 (Low) - NTFS-3G-SA_2026-06-1_05: Heap out-of-bounds read/write in ntfs_ie_add_vcn() CVSS: 6.2 (Moderate) CVE IDs have been requested by upstream but have not yet been published. EPEL 9 currently provides: ntfs-3g-2022.10.3-10.el9 Upstream has provided a patch set specifically for the 2022.10.3 release, so the fixes should be suitable for backporting to the EPEL 9 package. References: Upstream disclosure: https://www.openwall.com/lists/oss-security/2026/09/23/4 Fixed release: https://download.tuxera.com/opensource/ea5899b4ab87d243f6bed2f8fc13e6e5ff1f6d51fdf22b2ccbe708c8c0256166/ntfs-3g-2026.9.18.tar.gz 2022.10.3 security patch set: https://download.tuxera.com/opensource/ea5899b4ab87d243f6bed2f8fc13e6e5ff1f6d51fdf22b2ccbe708c8c0256166/ntfs-3g_2022.10.3_SR_2026-09_patches.tar.gz Please evaluate these vulnerabilities for Fedora EPEL, including EPEL 8, EPEL 9 and EPEL 10 where applicable, and backport the upstream security fixes as appropriate.
Could you please review whether the current EPEL ntfs-3g packages are affected by these vulnerabilities?
FEDORA-EPEL-2026-c518f1078d (ntfs-3g-2022.10.3-11.el9) has been submitted as an update to Fedora EPEL 9. https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-c518f1078d
FEDORA-EPEL-2026-c518f1078d has been pushed to the Fedora EPEL 9 testing repository. You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-c518f1078d See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.
Thank you for preparing the EPEL 9 security update. Could you also please apply the same upstream 2022.10.3 security patch set to the EPEL 10.2 package? EPEL 10.2 currently uses the 2022.10.3 release as well, so the same security fixes should be applicable there. Thank you.
FEDORA-EPEL-2026-1843885c69 (ntfs-3g-2022.10.3-12.el9) has been submitted as an update to Fedora EPEL 9. https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-1843885c69
FEDORA-EPEL-2026-1843885c69 has been pushed to the Fedora EPEL 9 testing repository. You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-1843885c69 See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.
FEDORA-EPEL-2026-1843885c69 (ntfs-3g-2022.10.3-13.el9, ntfs-3g-system-compression-1.1-2.el9, and 2 more) has been pushed to the Fedora EPEL 9 stable repository. If problem still persists, please make note of it in this bug report.