[Buildroot] [git commit branch/2026.05.x] package/ntfs-3g: security bump version to 2026.7.7

commit: https://gitlab.com/buildroot.org/buildroot/-/commit/9b4559d6f10d1a1b3ba78506da33c64c190e9d91
branch: https://gitlab.com/buildroot.org/buildroot/-/tree/2026.05.x

https://github.com/tuxera/ntfs-3g/wiki/NTFS-3G-Release-History
https://seclists.org/oss-sec/2026/q3/152

  Multiple vulnerabilities have been discovered in ntfs-3g.
  A new version 2026.7.7 is now available at https://github.com/tuxera/ntfs-3g

    (ntfscat) Fix heap memory corruption when processing a corrupt or maliciously crafted filesystem. (CVE-2026-42616)
    Fix heap memory corruption when copying index data from root to an index block in a corrupt or maliciously crafted filesystem. (CVE-2026-42617)
    Fix single-byte heap buffer overflow when decompressing maliciously crafted compressed file data. (CVE-2026-42618)
    Fix heap buffer overflow when copying the tail data of an index block to a freshly allocated block. (CVE-2026-46569)
    Fix out-of-bounds read when processing symlink reparse data in a corrupt or maliciously crafted filesystem. (CVE-2026-46571)
    Fix heap memory corruption for maliciously crafted or corrupt index data descending to an out-of-bounds tree depth. (CVE-2026-46570)
    Fix heap buffer overflow for maliciously crafted or corrupt index data during a node split. (CVE-2026-46572)
    Fix heap buffer overflow when building inherited ACL data. (CVE-2026-56135)
    Fix out of bounds access when clearing an index root in maliciously crafted or corrupt index data. (CVE-2026-56136)

Switched to sha256 tarball hash provided by upstream.

Signed-off-by: Bernd Kuhls <[email protected]>
Signed-off-by: Julien Olivain <[email protected]>
(cherry picked from commit 26811cb110217797fb44862aa401d68e73f9b1ae)
Signed-off-by: Thomas Perale <[email protected]>
---
 package/ntfs-3g/ntfs-3g.hash | 3 ++-
 package/ntfs-3g/ntfs-3g.mk   | 2 +-
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/package/ntfs-3g/ntfs-3g.hash b/package/ntfs-3g/ntfs-3g.hash
index 3fcba6af4d..6c68f227a8 100644
--- a/package/ntfs-3g/ntfs-3g.hash
+++ b/package/ntfs-3g/ntfs-3g.hash
@@ -1,4 +1,5 @@
+# From https://github.com/tuxera/ntfs-3g/releases/tag/2026.7.7
+sha256  d67b769025d32860549d35c2147e45024d172f81c540d750390ce3602c059dab  ntfs-3g_ntfsprogs-2026.7.7.tgz
 # Locally calculated
-sha256  f20e36ee68074b845e3629e6bced4706ad053804cbaf062fbae60738f854170c  ntfs-3g_ntfsprogs-2022.10.3.tgz
 sha256  231f7edcc7352d7734a96eef0b8030f77982678c516876fcb81e25b32d68564c  COPYING
 sha256  d7bf9d064ac3e5840f9dd02422b7eeec4f1fd03f37fadbd043602be5e882304f  COPYING.LIB
diff --git a/package/ntfs-3g/ntfs-3g.mk b/package/ntfs-3g/ntfs-3g.mk
index 62c515d50f..b44ad86290 100644
--- a/package/ntfs-3g/ntfs-3g.mk
+++ b/package/ntfs-3g/ntfs-3g.mk
@@ -4,7 +4,7 @@
 #
 ################################################################################
 
-NTFS_3G_VERSION = 2022.10.3
+NTFS_3G_VERSION = 2026.7.7
 NTFS_3G_SOURCE = ntfs-3g_ntfsprogs-$(NTFS_3G_VERSION).tgz
 NTFS_3G_SITE = http://tuxera.com/opensource
 NTFS_3G_CONF_OPTS = --disable-ldconfig
_______________________________________________
buildroot mailing list
[email protected]
https://lists.buildroot.org/mailman/listinfo/buildroot