new file mode 100644
@@ -0,0 +1,60 @@
+From 696eb743bd94ddbb86e84e544e152845b92a8a7f Mon Sep 17 00:00:00 2001
+From: Erik Larsson <erik@tuxera.com>
+Date: Tue, 24 Feb 2026 10:04:31 +0200
+Subject: [PATCH] acls.c: Fix heap buffer overflow in
+ 'ntfs_build_permissions_posix'.
+
+The root cause was that the memory allocated for the ACE entries was
+insufficient for the worst case scenario when group entries were added
+for mask entries that didn't have a corresponding group entry already.
+Fixed by allocating space for the worst case number of ACE entries.
+
+This was reported by Andrea Bocchetti with a thorough report which made
+it very easy to fix.
+
+CVE: CVE-2026-40706
+Upstream-Status: Backport [https://github.com/tuxera/ntfs-3g/commit/e48e1ef2a1fcff13a590c2224ec21c5bd5d3e92e]
+
+(cherry picked from commit e48e1ef2a1fcff13a590c2224ec21c5bd5d3e92e)
+Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
+---
+ libntfs-3g/acls.c | 25 ++++++++++++++++++++-----
+ 1 file changed, 20 insertions(+), 5 deletions(-)
+
+diff --git a/libntfs-3g/acls.c b/libntfs-3g/acls.c
+index 9f16fecd..4cf534bf 100644
+--- a/libntfs-3g/acls.c
++++ b/libntfs-3g/acls.c
+@@ -3716,12 +3716,27 @@ struct POSIX_SECURITY *ntfs_build_permissions_posix(
+ /*
+ * Build a raw posix security descriptor
+ * by just translating permissions and ids
+- * Add 2 to the count of ACE to be able to insert
+- * a group ACE later in access and default ACLs
+- * and add 2 more to be able to insert ACEs for owner
+- * and 2 more for other
++ *
++ * The worst case number of ACE entries consists of:
++ * - 'acecount' ACE entries from the main loop (see below)
++ * iterating over the 'securattr' array.
++ * - 1 ACE entry which may be added when creating world
++ * permissions if none exist.
++ * - 1 ACE entry which may be added when setting basic owner
++ * permissions if none exist (both lists).
++ * - 1 ACE entry which may be added when duplicating world
++ * permissions as group_obj permissions if none exist.
++ * - 'acecount + 2' ACE entries which may be added when
++ * duplicating world permissions as group permissions if they
++ * were converted to masks and the masks are not followed by a
++ * group entry.
++ * - 1 ACE entry which may be added when inserting a default
++ * mask if none is present and there are designated users or
++ * groups.
++ *
++ * This amounts to 2*acecnt + 6 ACE entries in the worst case.
+ */
+- alloccnt = acecnt + 6;
++ alloccnt = 2*acecnt + 6;
+ pxdesc = (struct POSIX_SECURITY*)malloc(
+ sizeof(struct POSIX_SECURITY)
+ + alloccnt*sizeof(struct POSIX_ACE));
new file mode 100644
@@ -0,0 +1,34 @@
+From a0842353864ad42abc30119af2fa5b9f5751d66b Mon Sep 17 00:00:00 2001
+From: Erik Larsson <erik@tuxera.com>
+Date: Tue, 24 Feb 2026 16:35:21 +0200
+Subject: [PATCH] acls.c: Add 'malloc' return value check when allocating POSIX
+ ACL.
+
+CVE: CVE-2026-40706
+Upstream-Status: Backport [https://github.com/tuxera/ntfs-3g/commit/c5413e242309f88ce5a83c0c2538184b19eea1bc]
+
+(cherry picked from commit c5413e242309f88ce5a83c0c2538184b19eea1bc)
+Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
+---
+ libntfs-3g/acls.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/libntfs-3g/acls.c b/libntfs-3g/acls.c
+index 4cf534bf..2d24d65e 100644
+--- a/libntfs-3g/acls.c
++++ b/libntfs-3g/acls.c
+@@ -3740,6 +3740,14 @@ struct POSIX_SECURITY *ntfs_build_permissions_posix(
+ pxdesc = (struct POSIX_SECURITY*)malloc(
+ sizeof(struct POSIX_SECURITY)
+ + alloccnt*sizeof(struct POSIX_ACE));
++ if (!pxdesc) {
++ ntfs_log_perror("Unable to allocate %zu bytes for "
++ "POSIX_SECURITY structure",
++ (size_t)(sizeof(struct POSIX_SECURITY) +
++ alloccnt*sizeof(struct POSIX_ACE)));
++ errno = ENOMEM;
++ return NULL;
++ }
+ k = 0;
+ l = alloccnt;
+ for (i=0; i<2; i++) {
@@ -17,6 +17,8 @@ SRC_URI = "http://tuxera.com/opensource/ntfs-3g_ntfsprogs-${PV}.tgz \
file://CVE-2026-42618_p1.patch \
file://CVE-2026-42618_p2.patch \
file://CVE-2026-42616.patch \
+ file://CVE-2026-40706_p1.patch \
+ file://CVE-2026-40706_p2.patch \
"
S = "${WORKDIR}/ntfs-3g_ntfsprogs-${PV}"
SRC_URI[sha256sum] = "f20e36ee68074b845e3629e6bced4706ad053804cbaf062fbae60738f854170c"