new file mode 100644
@@ -0,0 +1,70 @@
+From 96f3c15677c6aa0251798eef74a5a4c376523ee3 Mon Sep 17 00:00:00 2001
+From: Erik Larsson <erik@tuxera.com>
+Date: Fri, 24 Apr 2026 12:18:24 +0300
+Subject: [PATCH] ntfscat.c: Fix reading outside the buffer when block size >
+ buffer size.
+
+The block size may be read from the index root's 'index_block_size'
+member, and isn't guaranteed to be >= 4096 (as far as I can tell it
+could be larger). This would for MST protected records lead to storing
+data past the end of the allocated buffer.
+
+Fixed by allocating the necessary amount of buffer space for the case
+when the block size exceeds 4096.
+
+Thanks to Alexandro Calo' from Nozomi Networks Labs for reporting this
+issue.
+
+CVE: CVE-2026-42616
+Upstream-Status: Backport [https://github.com/tuxera/ntfs-3g/commit/dc1b682e99b6c055b0281ca543a8420b698420d1]
+
+(cherry picked from commit dc1b682e99b6c055b0281ca543a8420b698420d1)
+Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
+---
+ ntfsprogs/ntfscat.c | 16 ++++++++++------
+ 1 file changed, 10 insertions(+), 6 deletions(-)
+
+diff --git a/ntfsprogs/ntfscat.c b/ntfsprogs/ntfscat.c
+index b8af2503..0f711815 100644
+--- a/ntfsprogs/ntfscat.c
++++ b/ntfsprogs/ntfscat.c
+@@ -334,22 +334,17 @@ static int index_get_size(ntfs_inode *inode)
+ static int cat(ntfs_volume *vol, ntfs_inode *inode, ATTR_TYPES type,
+ ntfschar *name, int namelen)
+ {
+- const int bufsize = 4096;
+ char *buffer;
+ ntfs_attr *attr;
+ s64 bytes_read, written;
+ s64 offset;
+ u32 block_size;
+-
+- buffer = malloc(bufsize);
+- if (!buffer)
+- return 1;
++ u32 bufsize = 4096;
+
+ attr = ntfs_attr_open(inode, type, name, namelen);
+ if (!attr) {
+ ntfs_log_error("Cannot find attribute type 0x%x.\n",
+ le32_to_cpu(type));
+- free(buffer);
+ return 1;
+ }
+
+@@ -360,6 +355,15 @@ static int cat(ntfs_volume *vol, ntfs_inode *inode, ATTR_TYPES type,
+ else
+ block_size = 0;
+
++ if (bufsize < block_size) {
++ bufsize = block_size;
++ }
++
++ buffer = malloc(bufsize);
++ if (!buffer) {
++ return 1;
++ }
++
+ offset = 0;
+ for (;;) {
+ if (!opts.raw && block_size > 0) {
@@ -16,6 +16,7 @@ SRC_URI = "http://tuxera.com/opensource/ntfs-3g_ntfsprogs-${PV}.tgz \
file://CVE-2026-46569.patch \
file://CVE-2026-42618_p1.patch \
file://CVE-2026-42618_p2.patch \
+ file://CVE-2026-42616.patch \
"
S = "${WORKDIR}/ntfs-3g_ntfsprogs-${PV}"
SRC_URI[sha256sum] = "f20e36ee68074b845e3629e6bced4706ad053804cbaf062fbae60738f854170c"