new file mode 100644
@@ -0,0 +1,50 @@
+From fc32321c8c795e9f73cbdd8f36fcd9e0a3a9814b Mon Sep 17 00:00:00 2001
+From: Rakesh Pandit <rakesh@tuxera.com>
+Date: Mon, 8 Jun 2026 14:16:39 +0300
+Subject: [PATCH] reparse.c: Bounds-check locase index in ntfs_fix_file_name.
+
+The case-insensitive branch indexed vol->locase with a raw 16-bit code
+point and no check against vol->upcase_len. A truncated $UpCase made
+the table shorter than 65536 entries, so a file name character >=
+upcase_len read past it and leaked 2 heap bytes via the symlink target
+returned to userspace.
+
+Thanks to Alexandro Calo' from Nozomi Networks Labs for reporting this
+issue.
+
+CVE: CVE-2026-46571
+Upstream-Status: Backport [https://github.com/tuxera/ntfs-3g/commit/b912272b30c552b0457e40a0a68b1fac2587aaea]
+
+(cherry picked from commit b912272b30c552b0457e40a0a68b1fac2587aaea)
+Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
+---
+ libntfs-3g/reparse.c | 14 +++++++++++---
+ 1 file changed, 11 insertions(+), 3 deletions(-)
+
+diff --git a/libntfs-3g/reparse.c b/libntfs-3g/reparse.c
+index 76dbe2f1..54858caa 100644
+--- a/libntfs-3g/reparse.c
++++ b/libntfs-3g/reparse.c
+@@ -196,11 +196,19 @@ static u64 ntfs_fix_file_name(ntfs_inode *dir_ni, ntfschar *uname,
+ lemref = entry->indexed_file;
+ mref = le64_to_cpu(lemref);
+ if (NVolCaseSensitive(vol) || !vol->locase) {
+- for (i=0; i<found->file_name_length; i++)
++ for (i=0; i<found->file_name_length;
++ i++)
+ uname[i] = found->file_name[i];
+ } else {
+- for (i=0; i<found->file_name_length; i++)
+- uname[i] = vol->locase[le16_to_cpu(found->file_name[i])];
++ for (i=0; i<found->file_name_length;
++ i++) {
++ u16 u = le16_to_cpu(found->
++ file_name[i]);
++ uname[i] = (u < vol->upcase_len)
++ ? vol->locase[u]
++ : found->
++ file_name[i];
++ }
+ }
+ }
+ }
@@ -11,6 +11,7 @@ SRC_URI = "http://tuxera.com/opensource/ntfs-3g_ntfsprogs-${PV}.tgz \
file://CVE-2026-46572_CVE-2026-42617_p1.patch \
file://CVE-2026-46572_CVE-2026-42617_p2.patch \
file://CVE-2026-46572_CVE-2026-42617_p3.patch \
+ file://CVE-2026-46571.patch \
"
S = "${WORKDIR}/ntfs-3g_ntfsprogs-${PV}"
SRC_URI[sha256sum] = "f20e36ee68074b845e3629e6bced4706ad053804cbaf062fbae60738f854170c"