new file mode 100644
@@ -0,0 +1,70 @@
+From 96f3c15677c6aa0251798eef74a5a4c376523ee3 Mon Sep 17 00:00:00 2001
+From: Erik Larsson <erik@tuxera.com>
+Date: Fri, 24 Apr 2026 12:18:24 +0300
+Subject: [PATCH] ntfscat.c: Fix reading outside the buffer when block size >
+ buffer size.
+
+The block size may be read from the index root's 'index_block_size'
+member, and isn't guaranteed to be >= 4096 (as far as I can tell it
+could be larger). This would for MST protected records lead to storing
+data past the end of the allocated buffer.
+
+Fixed by allocating the necessary amount of buffer space for the case
+when the block size exceeds 4096.
+
+Thanks to Alexandro Calo' from Nozomi Networks Labs for reporting this
+issue.
+
+CVE: CVE-2026-42616
+Upstream-Status: Backport [https://github.com/tuxera/ntfs-3g/commit/dc1b682e99b6c055b0281ca543a8420b698420d1]
+
+(cherry picked from commit dc1b682e99b6c055b0281ca543a8420b698420d1)
+Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
+---
+ ntfsprogs/ntfscat.c | 16 ++++++++++------
+ 1 file changed, 10 insertions(+), 6 deletions(-)
+
+diff --git a/ntfsprogs/ntfscat.c b/ntfsprogs/ntfscat.c
+index b8af2503..0f711815 100644
+--- a/ntfsprogs/ntfscat.c
++++ b/ntfsprogs/ntfscat.c
+@@ -334,22 +334,17 @@ static int index_get_size(ntfs_inode *inode)
+ static int cat(ntfs_volume *vol, ntfs_inode *inode, ATTR_TYPES type,
+ ntfschar *name, int namelen)
+ {
+- const int bufsize = 4096;
+ char *buffer;
+ ntfs_attr *attr;
+ s64 bytes_read, written;
+ s64 offset;
+ u32 block_size;
+-
+- buffer = malloc(bufsize);
+- if (!buffer)
+- return 1;
++ u32 bufsize = 4096;
+
+ attr = ntfs_attr_open(inode, type, name, namelen);
+ if (!attr) {
+ ntfs_log_error("Cannot find attribute type 0x%x.\n",
+ le32_to_cpu(type));
+- free(buffer);
+ return 1;
+ }
+
+@@ -360,6 +355,15 @@ static int cat(ntfs_volume *vol, ntfs_inode *inode, ATTR_TYPES type,
+ else
+ block_size = 0;
+
++ if (bufsize < block_size) {
++ bufsize = block_size;
++ }
++
++ buffer = malloc(bufsize);
++ if (!buffer) {
++ return 1;
++ }
++
+ offset = 0;
+ for (;;) {
+ if (!opts.raw && block_size > 0) {
new file mode 100644
@@ -0,0 +1,79 @@
+From 8cd4718cad4941ef49ea5b3af8cd9ec68a46af7a Mon Sep 17 00:00:00 2001
+From: Erik Larsson <erik@tuxera.com>
+Date: Thu, 20 Aug 2026 15:52:23 +0300
+Subject: [PATCH] ntfscat.c: Fix missing cleanup of opened attribute on malloc
+ error.
+
+Reported as github issue #212. Impact is limited to non-existent as
+'malloc' doesn't fail in modern general-purpose operating systems.
+Additionally even if it does fail, process teardown will clean up any
+remaining resources allocated to the attribute, but it is technically a
+memory leak.
+
+CVE: CVE-2026-42616
+Upstream-Status: Backport [https://github.com/tuxera/ntfs-3g/commit/8cd4718cad4941ef49ea5b3af8cd9ec68a46af7a]
+
+(cherry picked from commit 8cd4718cad4941ef49ea5b3af8cd9ec68a46af7a)
+Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
+---
+ ntfsprogs/ntfscat.c | 23 +++++++++++++++--------
+ 1 file changed, 15 insertions(+), 8 deletions(-)
+
+diff --git a/ntfsprogs/ntfscat.c b/ntfsprogs/ntfscat.c
+index 0f711815..2bf5a2aa 100644
+--- a/ntfsprogs/ntfscat.c
++++ b/ntfsprogs/ntfscat.c
+@@ -334,8 +334,9 @@ static int index_get_size(ntfs_inode *inode)
+ static int cat(ntfs_volume *vol, ntfs_inode *inode, ATTR_TYPES type,
+ ntfschar *name, int namelen)
+ {
+- char *buffer;
+- ntfs_attr *attr;
++ int ret = 0;
++ ntfs_attr *attr = NULL;
++ char *buffer = NULL;
+ s64 bytes_read, written;
+ s64 offset;
+ u32 block_size;
+@@ -345,7 +346,8 @@ static int cat(ntfs_volume *vol, ntfs_inode *inode, ATTR_TYPES type,
+ if (!attr) {
+ ntfs_log_error("Cannot find attribute type 0x%x.\n",
+ le32_to_cpu(type));
+- return 1;
++ ret = 1;
++ goto out;
+ }
+
+ if ((inode->mft_no < 2) && (attr->type == AT_DATA))
+@@ -361,7 +363,8 @@ static int cat(ntfs_volume *vol, ntfs_inode *inode, ATTR_TYPES type,
+
+ buffer = malloc(bufsize);
+ if (!buffer) {
+- return 1;
++ ret = 1;
++ goto out;
+ }
+
+ offset = 0;
+@@ -389,10 +392,14 @@ static int cat(ntfs_volume *vol, ntfs_inode *inode, ATTR_TYPES type,
+ }
+ offset += bytes_read;
+ }
+-
+- ntfs_attr_close(attr);
+- free(buffer);
+- return 0;
++out:
++ if (buffer) {
++ free(buffer);
++ }
++ if (attr) {
++ ntfs_attr_close(attr);
++ }
++ return ret;
+ }
+
+ /**
+--
+2.35.6
+
@@ -17,6 +17,8 @@ SRC_URI = "git://github.com/tuxera/ntfs-3g;protocol=https;branch=edge;tag=${PV}
file://CVE-2026-46569.patch \
file://CVE-2026-42618_p1.patch \
file://CVE-2026-42618_p2.patch \
+ file://CVE-2026-42616_p1.patch \
+ file://CVE-2026-42616_p2.patch \
"
SRCREV = "78414d93613532fd82f3a82aba5d4a1c32898781"