new file mode 100644
@@ -0,0 +1,62 @@
+From 677d21be1ac7ec0a59cfbed8e26d1ffbf0922ac1 Mon Sep 17 00:00:00 2001
+From: Rakesh Pandit <rakesh@tuxera.com>
+Date: Mon, 8 Jun 2026 10:34:38 +0300
+Subject: [PATCH] Bound tail_size in ntfs_ib_copy_tail against destination
+ capacity.
+
+A crafted source INDX block can drive tail_size past the freshly
+allocated destination's usable space and overflow the memcpy. Add
+a capacity check (and a < 0 guard against sign-extension at
+memcpy).
+
+Thanks to Alexandro Calo' from Nozomi Networks Labs for reporting
+this issue.
+
+CVE: CVE-2026-46569
+Upstream-Status: Backport [https://github.com/tuxera/ntfs-3g/commit/961ed5c2fa2f36ef6a347f04e1fa586113c97e7c]
+
+(cherry picked from commit 961ed5c2fa2f36ef6a347f04e1fa586113c97e7c)
+Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
+---
+ libntfs-3g/index.c | 21 ++++++++++++++++++++-
+ 1 file changed, 20 insertions(+), 1 deletion(-)
+
+diff --git a/libntfs-3g/index.c b/libntfs-3g/index.c
+index 9c11a45c..347bd408 100644
+--- a/libntfs-3g/index.c
++++ b/libntfs-3g/index.c
+@@ -1193,7 +1193,7 @@ static int ntfs_ib_copy_tail(ntfs_index_context *icx, INDEX_BLOCK *src,
+ {
+ u8 *ies_end;
+ INDEX_ENTRY *ie_head; /* first entry after the median */
+- int tail_size, ret;
++ int tail_size, dst_capacity, ret;
+ INDEX_BLOCK *dst;
+
+ ntfs_log_trace("Entering\n");
+@@ -1207,6 +1207,25 @@ static int ntfs_ib_copy_tail(ntfs_index_context *icx, INDEX_BLOCK *src,
+
+ ies_end = (u8 *)ntfs_ie_get_end(&src->index);
+ tail_size = ies_end - (u8 *)ie_head;
++ dst_capacity = (int)(le32_to_cpu(dst->index.allocated_size)
++ - le32_to_cpu(dst->index.entries_offset));
++
++ /*
++ * src->index.entries_offset (on-disk, only required to be >=
++ * sizeof(INDEX_HEADER) by ntfs_index_block_inconsistent) may be smaller
++ * than dst's, which ntfs_ib_alloc fixes (40 on a 4 KiB block). When
++ * the median lands near the start of the source stream the gap lets
++ * tail_size exceed dst's usable space. The < 0 guard catches a
++ * negative tail_size before memcpy sign-extends it into a huge size_t.
++ */
++ if (tail_size < 0 || tail_size > dst_capacity) {
++ ntfs_log_error("Invalid tail_size %d (dst capacity %d) in "
++ "ntfs_ib_copy_tail\n", tail_size, dst_capacity);
++ free(dst);
++ errno = EIO;
++ return STATUS_ERROR;
++ }
++
+ memcpy(ntfs_ie_get_first(&dst->index), ie_head, tail_size);
+
+ dst->index.index_length = cpu_to_le32(tail_size +
@@ -13,6 +13,7 @@ SRC_URI = "http://tuxera.com/opensource/ntfs-3g_ntfsprogs-${PV}.tgz \
file://CVE-2026-46572_CVE-2026-42617_p3.patch \
file://CVE-2026-46571.patch \
file://CVE-2026-46570.patch \
+ file://CVE-2026-46569.patch \
"
S = "${WORKDIR}/ntfs-3g_ntfsprogs-${PV}"
SRC_URI[sha256sum] = "f20e36ee68074b845e3629e6bced4706ad053804cbaf062fbae60738f854170c"