CVE-2026-72188 Linux CVE debrief

Who should care

Linux kernel developers, administrators responsible for maintaining Linux systems, and security teams should be aware of this vulnerability and take necessary actions to ensure the ntfs_lookup_inode_by_name() function is properly validating error-marked MFT references. This includes reviewing Linux kernel configurations, monitoring Linux kernel updates, and applying patches as necessary. Additionally, operators and platform administrators should review the vulnerability details and assess the potential impact on their systems. Vulnerability management teams should prioritize patching and verifying the validation of MFT references in the Linux kernel. Security teams should also review compensating controls and implement monitoring to detect potential exploitation attempts. Asset inventory management teams should verify that affected systems are identified and prioritized for patching. Change management and incident response teams should be prepared to respond to potential exploitation incidents. IT teams responsible for Linux kernel maintenance should apply updates and patches promptly to prevent exploitation. Linux distribution maintainers should review and update their packages to ensure the fix is properly integrated. Security researchers and penetration testers may also want to review the vulnerability details to understand the potential attack surface and develop tests to verify the fix. Finally, Linux kernel contributors and maintainers should review the code changes and ensure that similar issues are addressed in the future. The vulnerability affects Linux kernel versions and may impact various Linux distributions. Users of affected systems should prioritize patching and take additional defensive measures to mitigate potential risks. The vulnerability has been resolved in the Linux kernel, and users are advised to apply the fix as soon as possible. Linux kernel developers and maintainers should also review the code changes and ensure that similar issues are addressed in the future. The issue is particularly relevant for environments where untrusted NTFS images are mounted or processed. System administrators should prioritize patching and take additional (

Technical summary

The Linux kernel has a vulnerability in the ntfs_lookup_inode_by_name() function, which can return an error-marked MFT reference without validation. This can cause callers to consume a bogus pseudo-errno instead of treating the lookup result as corrupted on-disk metadata. The issue has been resolved by normalizing every error-marked MFT reference returned from ntfs_lookup_inode_by_name() to ERR_MREF(-EIO).

Defensive priority

Apply Linux kernel updates to ensure the ntfs_lookup_inode_by_name() function is properly validating error-marked MFT references.

Recommended defensive actions

• Apply Linux kernel updates to ensure the ntfs_lookup_inode_by_name() function is properly validating error-marked MFT references.
• Review Linux kernel configurations and ensure proper validation of MFT references.
• Monitor Linux kernel updates and apply patches as necessary.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The CVE record and NVD entry provide limited information about the vulnerability. Further analysis of the Linux kernel source code and ntfs_lookup_inode_by_name() function is required to fully understand the issue.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.