GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-72195 (GCVE-0-2026-72195)

Vulnerability from cvelistv5 – Published: 2026-08-15 05:53 – Updated: 2026-08-17 05:41
VLAI
Title
fs/ntfs3: bound attr_off in UpdateResidentValue against data_off
Summary
In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: bound attr_off in UpdateResidentValue against data_off In do_action()'s UpdateResidentValue case (fslog.c:3307), lrh->attr_off and lrh->redo_len come from the on-disk LRH. When they satisfy aoff + dlen < attr->res.data_off, the assignment attr->res.data_size = cpu_to_le32(aoff + dlen - data_off); underflows to ~4 GiB (e.g. 0xFFFFFFF9 when aoff=0x10, dlen=1, data_off=0x18). Subsequent code that reads attr->res.data_size to walk the resident attribute payload would then read up to 4 GiB past the 1024-byte MFT record allocation. The existing mi_enum_attr() defense in fs/ntfs3/record.c:287 catches the corrupted data_size on the next attribute walk and fails the mount, but only on the path that walks all attributes. A read site that picks an attribute by name and reads its data_size without re-validating is not covered. Validate aoff against data_off and asize at the source. Reproduced under UML+KASAN on mainline 8d90b09e6741 via pr_warn-only probe: with aoff=0x10 and data_off=0x18, the post-assignment data_size is 0xfffffff9 (mount then fails at -22 from mi_enum_attr). [almaz.alexandrovich@paragon-software.com: clang-formatted the changes]
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: b46acd6a6a627d876898e1c84d3f84902264b445 , < ab8761676d638c5be170aaf91b7ffdd451236616 (git)
Affected: b46acd6a6a627d876898e1c84d3f84902264b445 , < 53c12f178f584dc5f836ffe2782138a6e9348ed9 (git)
Affected: b46acd6a6a627d876898e1c84d3f84902264b445 , < 546518468e6c9ea469669eef78f8cc380ad6e2ca (git)
Affected: b46acd6a6a627d876898e1c84d3f84902264b445 , < 97758fd9756b5f09e9ddc6a5f6a569041acc8421 (git)
Affected: b46acd6a6a627d876898e1c84d3f84902264b445 , < 50b5e83384e7fed3d11d18b79ff350e9d6d89861 (git)
Affected: b46acd6a6a627d876898e1c84d3f84902264b445 , < a89c66674283a0293c0f266dc57087a6114371a3 (git)
Affected: b46acd6a6a627d876898e1c84d3f84902264b445 , < d1570c48f49a693974d000251030370ee2e83539 (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.15
Unaffected: 0 , < 5.15 (semver)
Unaffected: 5.15.212 , ≤ 5.15.* (semver)
Unaffected: 6.1.178 , ≤ 6.1.* (semver)
Unaffected: 6.6.145 , ≤ 6.6.* (semver)
Unaffected: 6.12.97 , ≤ 6.12.* (semver)
Unaffected: 6.18.40 , ≤ 6.18.* (semver)
Unaffected: 7.1.5 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/ntfs3/fslog.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "ab8761676d638c5be170aaf91b7ffdd451236616",
              "status": "affected",
              "version": "b46acd6a6a627d876898e1c84d3f84902264b445",
              "versionType": "git"
            },
            {
              "lessThan": "53c12f178f584dc5f836ffe2782138a6e9348ed9",
              "status": "affected",
              "version": "b46acd6a6a627d876898e1c84d3f84902264b445",
              "versionType": "git"
            },
            {
              "lessThan": "546518468e6c9ea469669eef78f8cc380ad6e2ca",
              "status": "affected",
              "version": "b46acd6a6a627d876898e1c84d3f84902264b445",
              "versionType": "git"
            },
            {
              "lessThan": "97758fd9756b5f09e9ddc6a5f6a569041acc8421",
              "status": "affected",
              "version": "b46acd6a6a627d876898e1c84d3f84902264b445",
              "versionType": "git"
            },
            {
              "lessThan": "50b5e83384e7fed3d11d18b79ff350e9d6d89861",
              "status": "affected",
              "version": "b46acd6a6a627d876898e1c84d3f84902264b445",
              "versionType": "git"
            },
            {
              "lessThan": "a89c66674283a0293c0f266dc57087a6114371a3",
              "status": "affected",
              "version": "b46acd6a6a627d876898e1c84d3f84902264b445",
              "versionType": "git"
            },
            {
              "lessThan": "d1570c48f49a693974d000251030370ee2e83539",
              "status": "affected",
              "version": "b46acd6a6a627d876898e1c84d3f84902264b445",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/ntfs3/fslog.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.15"
            },
            {
              "lessThan": "5.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.212",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.97",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.40",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.212",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.178",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.97",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.40",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs/ntfs3: bound attr_off in UpdateResidentValue against data_off\n\nIn do_action()\u0027s UpdateResidentValue case (fslog.c:3307),\nlrh-\u003eattr_off and lrh-\u003eredo_len come from the on-disk LRH.\nWhen they satisfy aoff + dlen \u003c attr-\u003eres.data_off, the\nassignment\n\n\tattr-\u003eres.data_size = cpu_to_le32(aoff + dlen - data_off);\n\nunderflows to ~4 GiB (e.g. 0xFFFFFFF9 when aoff=0x10, dlen=1,\ndata_off=0x18).  Subsequent code that reads attr-\u003eres.data_size\nto walk the resident attribute payload would then read up to\n4 GiB past the 1024-byte MFT record allocation.\n\nThe existing mi_enum_attr() defense in fs/ntfs3/record.c:287\ncatches the corrupted data_size on the next attribute walk\nand fails the mount, but only on the path that walks all\nattributes.  A read site that picks an attribute by name and\nreads its data_size without re-validating is not covered.\nValidate aoff against data_off and asize at the source.\n\nReproduced under UML+KASAN on mainline 8d90b09e6741 via\npr_warn-only probe: with aoff=0x10 and data_off=0x18, the\npost-assignment data_size is 0xfffffff9 (mount then fails\nat -22 from mi_enum_attr).\n\n[almaz.alexandrovich@paragon-software.com: clang-formatted the changes]"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is reached only when the kernel mounts an attacker-controlled NTFS volume and replays $LogFile via ntfs_loadlog_and_replay\u2192log_replay\u2192do_action(UpdateResidentValue); exploitation uses the local mount syscall on a block/loop device, not a network-facing kernel service.\nAC:L - The attacker fully controls malicious on-disk LRH fields (attr_off, redo_len, data) in $LogFile; triggering the data_size underflow is deterministic once the crafted volume is mounted, with no races or conditions outside attacker control.\nPR:L - Mounting ntfs3 requires CAP_SYS_ADMIN in the mount namespace; an unprivileged local attacker can obtain this via user namespaces (unshare -Ur) and loop-mount a crafted NTFS image, without real root in the initial user namespace.\nUI:N - No victim interaction is required when the attacker mounts their own malicious NTFS image in a user namespace; exploitation does not depend on another user plugging in media, opening a file, or performing an additional action.\nS:U - The vulnerability corrupts kernel heap metadata during filesystem journal replay on the mounting host; impact stays within the kernel\u0027s security authority and does not constitute a VM escape, sandbox escape, or cross-authority boundary change.\nC:H - Unsigned underflow sets attr-\u003eres.data_size to ~4 GiB; subsequent resident-attribute consumers that trust data_size can read far beyond the ~1 KiB kmalloc MFT record allocation, disclosing adjacent kernel heap memory.\nI:H - The underflow corrupts resident-attribute metadata and UpdateResidentValue memmove paths using attacker-controlled offsets can overwrite attribute headers and drive out-of-bounds writes during replay, enabling heap corruption suitable for control-flow hijacking.\nA:H - Malformed journal replay can trigger kernel faults (KASAN/oops) or abort mount; repeated mount attempts against the malicious image cause persistent denial of service on the affected system."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:41:21.899Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/ab8761676d638c5be170aaf91b7ffdd451236616"
        },
        {
          "url": "https://git.kernel.org/stable/c/53c12f178f584dc5f836ffe2782138a6e9348ed9"
        },
        {
          "url": "https://git.kernel.org/stable/c/546518468e6c9ea469669eef78f8cc380ad6e2ca"
        },
        {
          "url": "https://git.kernel.org/stable/c/97758fd9756b5f09e9ddc6a5f6a569041acc8421"
        },
        {
          "url": "https://git.kernel.org/stable/c/50b5e83384e7fed3d11d18b79ff350e9d6d89861"
        },
        {
          "url": "https://git.kernel.org/stable/c/a89c66674283a0293c0f266dc57087a6114371a3"
        },
        {
          "url": "https://git.kernel.org/stable/c/d1570c48f49a693974d000251030370ee2e83539"
        }
      ],
      "title": "fs/ntfs3: bound attr_off in UpdateResidentValue against data_off",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-72195",
    "datePublished": "2026-08-15T05:53:54.869Z",
    "dateReserved": "2026-08-09T03:40:39.911Z",
    "dateUpdated": "2026-08-17T05:41:21.899Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-72195",
      "date": "2026-09-15",
      "epss": "0.00169",
      "percentile": "0.06522"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-72195\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-08-15T06:21:38.077\",\"lastModified\":\"2026-08-17T06:18:20.207\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nfs/ntfs3: bound attr_off in UpdateResidentValue against data_off\\n\\nIn do_action()\u0027s UpdateResidentValue case (fslog.c:3307),\\nlrh-\u003eattr_off and lrh-\u003eredo_len come from the on-disk LRH.\\nWhen they satisfy aoff + dlen \u003c attr-\u003eres.data_off, the\\nassignment\\n\\n\\tattr-\u003eres.data_size = cpu_to_le32(aoff + dlen - data_off);\\n\\nunderflows to ~4 GiB (e.g. 0xFFFFFFF9 when aoff=0x10, dlen=1,\\ndata_off=0x18).  Subsequent code that reads attr-\u003eres.data_size\\nto walk the resident attribute payload would then read up to\\n4 GiB past the 1024-byte MFT record allocation.\\n\\nThe existing mi_enum_attr() defense in fs/ntfs3/record.c:287\\ncatches the corrupted data_size on the next attribute walk\\nand fails the mount, but only on the path that walks all\\nattributes.  A read site that picks an attribute by name and\\nreads its data_size without re-validating is not covered.\\nValidate aoff against data_off and asize at the source.\\n\\nReproduced under UML+KASAN on mainline 8d90b09e6741 via\\npr_warn-only probe: with aoff=0x10 and data_off=0x18, the\\npost-assignment data_size is 0xfffffff9 (mount then fails\\nat -22 from mi_enum_attr).\\n\\n[almaz.alexandrovich@paragon-software.com: clang-formatted the changes]\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"fs/ntfs3/fslog.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"b46acd6a6a627d876898e1c84d3f84902264b445\",\"lessThan\":\"ab8761676d638c5be170aaf91b7ffdd451236616\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"b46acd6a6a627d876898e1c84d3f84902264b445\",\"lessThan\":\"53c12f178f584dc5f836ffe2782138a6e9348ed9\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"b46acd6a6a627d876898e1c84d3f84902264b445\",\"lessThan\":\"546518468e6c9ea469669eef78f8cc380ad6e2ca\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"b46acd6a6a627d876898e1c84d3f84902264b445\",\"lessThan\":\"97758fd9756b5f09e9ddc6a5f6a569041acc8421\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"b46acd6a6a627d876898e1c84d3f84902264b445\",\"lessThan\":\"50b5e83384e7fed3d11d18b79ff350e9d6d89861\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"b46acd6a6a627d876898e1c84d3f84902264b445\",\"lessThan\":\"a89c66674283a0293c0f266dc57087a6114371a3\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"b46acd6a6a627d876898e1c84d3f84902264b445\",\"lessThan\":\"d1570c48f49a693974d000251030370ee2e83539\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"fs/ntfs3/fslog.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.15\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.15\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.212\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.178\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.145\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.97\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.40\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.5\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/50b5e83384e7fed3d11d18b79ff350e9d6d89861\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/53c12f178f584dc5f836ffe2782138a6e9348ed9\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/546518468e6c9ea469669eef78f8cc380ad6e2ca\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/97758fd9756b5f09e9ddc6a5f6a569041acc8421\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/a89c66674283a0293c0f266dc57087a6114371a3\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/ab8761676d638c5be170aaf91b7ffdd451236616\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/d1570c48f49a693974d000251030370ee2e83539\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-18T15:33:08+00:00",
      "cve": "CVE-2026-72195",
      "id": "CVE-2026-72195",
      "initial_release_date": "2026-08-15T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: fs/ntfs3: bound attr_off in UpdateResidentValue against data_off",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-72195.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-31T16:27:12Z",
      "cve": "CVE-2026-72195",
      "id": "CVE-2026-72195",
      "initial_release_date": "2026-08-31T16:27:12Z",
      "product_status:known_affected": "82",
      "product_status:known_not_affected": "280",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-72195",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-72195.json",
      "version": "2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.