CVE-2026-72191 Linux CVE debrief

Who should care

Linux kernel developers, Linux distribution maintainers, and users of Linux systems that use the ntfs3 module. The vulnerability affects Linux kernel versions prior to the patched version. The vulnerability has a high impact on the system's confidentiality, integrity, and availability. The vulnerability requires local access to the system and can be exploited by a low-privileged user.

Technical summary

The vulnerability is due to a lack of validation in the hdr_find_split function, which can return a split point that extends past the end of the buffer. This can cause an out-of-bounds kernel write, leading to a kernel panic. The vulnerability affects the Linux kernel's ntfs3 module. The vulnerability can be exploited by a local attacker with low privileges. The vulnerability has a high impact on the system's confidentiality, integrity, and availability.

Defensive priority

High

Recommended defensive actions

• Apply the patch from the Linux kernel stable repository
• Restrict access to the vulnerable system
• Monitor system logs for suspicious activity
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability was discovered in the Linux kernel's ntfs3 module. A crafted NTFS image can cause an out-of-bounds kernel write, leading to a kernel panic. The vulnerability is due to a lack of validation in the hdr_find_split function. The vulnerability was reported by an unknown researcher and patched by a Linux kernel developer. The patch was applied to the Linux kernel stable repository. The vulnerability affects Linux kernel versions prior to the patched version. The vulnerability has a high impact on the system's confidentiality, integrity, and availability. The vulnerability requires local access to the system and can be exploited by a low-privileged user. The vulnerability can be mitigated by restricting access to the vulnerable system, monitoring system logs for suspicious activity, and applying the patch from the Linux kernel stable repository.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.