CVE-2026-72199

In the Linux kernel, the following vulnerability has been resolved:

ntfs: validate resident index root values on lookup

Resident $INDEX_ROOT values carry index header fields that callers

consume after lookup. Some callers already validate parts of the layout

before walking entries, but those checks are scattered and do not cover

all root header invariants, such as entries_offset alignment and lower

bound, indexlength, and allocatedsize consistency.

The resident root resize paths now keep these header fields consistent

while the value size changes: ntfsirtruncate() lowers

index.allocated_size before shrinking the resident value, and

ntfsirreparent() grows the resident value before publishing a larger

root header. Lookup-time validation can therefore cover these invariants

without tripping over the driver's own resize paths.

Add $INDEX_ROOT to the minimum resident value size table and validate the

resident index header fields before returning the attribute from lookup.

Require 8-byte aligned index header fields, a sane entries_offset, an

indexlength within allocatedsize, allocated_size within the resident

value, and enough entry space for at least an index entry header.

The shared validator already rejects non-resident records for

resident-only attribute types, including $INDEX_ROOT.