CVE-2026-72194

In the Linux kernel, the following vulnerability has been resolved:

fs/ntfs3: add depth limit to indxfindbuffer to prevent stack overflow

indxfindbuffer() recursively descends the B+ tree index with no depth

limit.  A crafted NTFS image with circular index node references causes

unbounded recursion, overflowing the kernel stack and panicking the

system.

This is reachable by mounting a malicious NTFS filesystem (e.g. from a

USB drive via desktop automount) and deleting a file whose index entry

triggers the rebalancing fallback path in indxdeleteentry().

Add a depth parameter and bail out with -EINVAL when it reaches the

fnd->nodes array bound, matching the constraint already enforced by

fndpush() in indxfind().

The related function indx_find() was previously patched for a similar

infinite-loop issue (commit 1732053c8a6b), but indxfindbuffer() was

missed.