diff --git a/meta-filesystems/recipes-filesystems/ntfs-3g-ntfsprogs/files/CVE-2026-46569.patch b/meta-filesystems/recipes-filesystems/ntfs-3g-ntfsprogs/files/CVE-2026-46569.patch
new file mode 100644
index 0000000000..5c496159ec
--- /dev/null
+++ b/meta-filesystems/recipes-filesystems/ntfs-3g-ntfsprogs/files/CVE-2026-46569.patch
@@ -0,0 +1,62 @@
+From 677d21be1ac7ec0a59cfbed8e26d1ffbf0922ac1 Mon Sep 17 00:00:00 2001
+From: Rakesh Pandit <rakesh@tuxera.com>
+Date: Mon, 8 Jun 2026 10:34:38 +0300
+Subject: [PATCH] Bound tail_size in ntfs_ib_copy_tail against destination
+ capacity.
+
+A crafted source INDX block can drive tail_size past the freshly
+allocated destination's usable space and overflow the memcpy.  Add
+a capacity check (and a < 0 guard against sign-extension at
+memcpy).
+
+Thanks to Alexandro Calo' from Nozomi Networks Labs for reporting
+this issue.
+
+CVE: CVE-2026-46569
+Upstream-Status: Backport [https://github.com/tuxera/ntfs-3g/commit/961ed5c2fa2f36ef6a347f04e1fa586113c97e7c]
+
+(cherry picked from commit 961ed5c2fa2f36ef6a347f04e1fa586113c97e7c)
+Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
+---
+ libntfs-3g/index.c | 21 ++++++++++++++++++++-
+ 1 file changed, 20 insertions(+), 1 deletion(-)
+
+diff --git a/libntfs-3g/index.c b/libntfs-3g/index.c
+index 9c11a45c..347bd408 100644
+--- a/libntfs-3g/index.c
++++ b/libntfs-3g/index.c
+@@ -1193,7 +1193,7 @@ static int ntfs_ib_copy_tail(ntfs_index_context *icx, INDEX_BLOCK *src,
+ {
+ 	u8 *ies_end;
+ 	INDEX_ENTRY *ie_head;		/* first entry after the median */
+-	int tail_size, ret;
++	int tail_size, dst_capacity, ret;
+ 	INDEX_BLOCK *dst;
+ 	
+ 	ntfs_log_trace("Entering\n");
+@@ -1207,6 +1207,25 @@ static int ntfs_ib_copy_tail(ntfs_index_context *icx, INDEX_BLOCK *src,
+ 	
+ 	ies_end = (u8 *)ntfs_ie_get_end(&src->index);
+ 	tail_size = ies_end - (u8 *)ie_head;
++	dst_capacity = (int)(le32_to_cpu(dst->index.allocated_size)
++			     - le32_to_cpu(dst->index.entries_offset));
++
++	/*
++	 * src->index.entries_offset (on-disk, only required to be >=
++	 * sizeof(INDEX_HEADER) by ntfs_index_block_inconsistent) may be smaller
++	 * than dst's, which ntfs_ib_alloc fixes (40 on a 4 KiB block).  When
++	 * the median lands near the start of the source stream the gap lets
++	 * tail_size exceed dst's usable space.  The < 0 guard catches a
++	 * negative tail_size before memcpy sign-extends it into a huge size_t.
++	 */
++	if (tail_size < 0 || tail_size > dst_capacity) {
++		ntfs_log_error("Invalid tail_size %d (dst capacity %d) in "
++				"ntfs_ib_copy_tail\n", tail_size, dst_capacity);
++		free(dst);
++		errno = EIO;
++		return STATUS_ERROR;
++	}
++
+ 	memcpy(ntfs_ie_get_first(&dst->index), ie_head, tail_size);
+ 	
+ 	dst->index.index_length = cpu_to_le32(tail_size + 
diff --git a/meta-filesystems/recipes-filesystems/ntfs-3g-ntfsprogs/ntfs-3g-ntfsprogs_2022.10.3.bb b/meta-filesystems/recipes-filesystems/ntfs-3g-ntfsprogs/ntfs-3g-ntfsprogs_2022.10.3.bb
index e17c3d2481..f4f4ccfdf1 100644
--- a/meta-filesystems/recipes-filesystems/ntfs-3g-ntfsprogs/ntfs-3g-ntfsprogs_2022.10.3.bb
+++ b/meta-filesystems/recipes-filesystems/ntfs-3g-ntfsprogs/ntfs-3g-ntfsprogs_2022.10.3.bb
@@ -14,6 +14,7 @@ SRC_URI = "git://github.com/tuxera/ntfs-3g;protocol=https;branch=edge;tag=${PV}
            file://CVE-2026-46572_CVE-2026-42617_p3.patch \
            file://CVE-2026-46571.patch \
            file://CVE-2026-46570.patch \
+           file://CVE-2026-46569.patch \
 "
 SRCREV = "78414d93613532fd82f3a82aba5d4a1c32898781"