CVE-2026-72210

In the Linux kernel, the following vulnerability has been resolved:

ntfs: fix off-by-one in mapping pairs decoding bounds checks

In ntfsmappingpairsdecompress(), attrend points one byte past the

end of the attribute record:

    attrend = (u8 *)attr + le32to_cpu(attr->length);

The two bounds checks validating that mapping pair data bytes fit within

the attribute use strict greater-than (>), which allows a one-byte

out-of-bounds read when the data extends exactly to attr_end:

  b = *buf & 0xf;

  if (b) {

      if (unlikely(buf + b > attr_end))   // off-by-one

          goto io_error;

      for (deltaxcn = (s8)buf[b--]; b; b--)

          deltaxcn = (deltaxcn << 8) + buf[b];

  }

When buf + b == attr_end, the check evaluates to false and buf[b] reads

one byte past the valid attribute boundary. The same pattern appears in

the LCN delta bytes check.

Fix both checks to use >= so that buf[b] at exactly attr_end is

correctly rejected as out of bounds.