CVE-2026-72187 Linux CVE debrief

Who should care

Linux kernel developers and maintainers, Linux distribution vendors, and users of Linux-based systems, particularly those utilizing the ntfs filesystem, should be aware of this issue and take necessary precautions to prevent potential exploitation. This includes assessing Linux kernel installations for potential exposure, applying vendor patches or updates to address the vulnerability, and monitoring system logs for indicators of potential exploitation attempts. Additionally, system administrators and security teams responsible for maintaining Linux-based systems should review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance, and plan vendor-supported updates or mitigations through normal change control where exposure is confirmed. Compensating controls for exposed systems should be reviewed while remediation is scheduled and verified, and relevant monitoring, detection, and logs for exposed assets should be checked for extra review. Exceptions, retested remediated assets, and closed items should be tracked, with evidence documented before closure. Asset inventory and vulnerability management teams should also be informed to ensure accurate tracking and prioritization of remediation efforts. Security teams should consider the potential operational impact of this vulnerability and review context to ensure proper prioritization and mitigation. The CVE record was published on 2026-08-15T06:21:37.077Z and has not been modified since then, indicating that this issue has been publicly disclosed and should be treated with high priority. Linux kernel developers and maintainers should also review the technical summary and evidence notes to understand the vulnerability and its potential impact on their systems. Linux distribution vendors should assess their products for potential exposure and provide guidance to their users. Users of Linux-based systems should be aware of the potential risks and take necessary precautions to protect their systems. Overall, a coordinated effort is required to address this vulnerability and prevent potential exploitation. The issue is addressed by grabbing a reference to the base inode,

Technical summary

The Linux kernel's ntfs filesystem implementation is vulnerable to a self-deadlock issue during inode eviction. An attribute-list update performed while allocating clusters can drop the last reference to the temporary attribute inode. Evicting that inode drops its reference to the base inode and can invoke ntfs_drop_big_inode() for the base inode from within the base inode's own writeback path. This leads to a deadlock when the writeback worker waits for itself indefinitely. The issue is addressed by grabbing a reference to the base inode at the beginning of ntfs_writepages() and releasing it at the end of the function, deferring eviction until all bios have been submitted.

Defensive priority

Medium

Recommended defensive actions

• Inventory and assess Linux kernel installations for potential exposure
• Apply vendor patches or updates to address the vulnerability
• Monitor system logs for indicators of potential exploitation attempts
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance

Evidence notes

The issue arises from a self-deadlock during inode eviction in the ntfs filesystem. An attribute-list update can drop the last reference to the temporary attribute inode. Evicting that inode drops its reference to the base inode and can invoke ntfs_drop_big_inode() for the base inode from within the base inode's own writeback path. To prevent this self-deadlock, a reference to the base inode is grabbed at the beginning of ntfs_writepages() and released at the end of the function.

Official resources