DEBIAN-CVE-2026-72210

In the Linux kernel, the following vulnerability has been resolved:  ntfs: fix off-by-one in mapping pairs decoding bounds checks  In ntfsmappingpairsdecompress(), attrend points one byte past the end of the attribute record:      attrend = (u8 *)attr + le32tocpu(attr->length);  The two bounds checks validating that mapping pair data bytes fit within the attribute use strict greater-than (>), which allows a one-byte out-of-bounds read when the data extends exactly to attrend:    b = *buf & 0xf;   if (b) {       if (unlikely(buf + b > attrend))   // off-by-one           goto ioerror;       for (deltaxcn = (s8)buf[b--]; b; b--)           deltaxcn = (deltaxcn << 8) + buf[b];   }  When buf + b == attrend, the check evaluates to false and buf[b] reads one byte past the valid attribute boundary. The same pattern appears in the LCN delta bytes check.  Fix both checks to use >= so that buf[b] at exactly attrend is correctly rejected as out of bounds.