CVE-2026-72193 Linux CVE debrief

Who should care

Linux kernel developers and maintainers, Linux distribution vendors, and users of Linux systems that support NTFS3 disk images should be aware of this vulnerability. They should review the patch and apply it to affected systems to prevent exploitation. Additionally, they should monitor for suspicious activity related to NTFS3 disk images and consider implementing compensating controls, such as restricting access to NTFS3 disk images. Security teams should review the vulnerability and assess the risk to their organization. They should also ensure that their systems are updated with the patched driver and monitor for potential attacks. IT teams should prioritize patching affected systems and consider implementing additional security controls to prevent exploitation. Asset owners should inventory and assess Linux kernel installations for potential exposure and prioritize patching affected systems. Vulnerability management teams should review the vulnerability and assess the risk to their organization. They should also ensure that their systems are updated with the patched driver and monitor for potential attacks. Compensating controls, such as restricting access to NTFS3 disk images, should be considered while remediation is scheduled and verified. Monitoring and detection capabilities should be reviewed to ensure that they can detect potential attacks. Exceptions should be tracked, and remediated assets should be retested to ensure that the patch has been applied successfully. The patch should be applied through normal change control processes, and affected scope, severity, and vendor guidance should be validated. The vulnerability should be reviewed in the context of the organization's overall risk management strategy. The patched driver should be verified to ensure that it is functioning correctly. Rollback and change windows should be planned and implemented as necessary to minimize disruption to operations. Source tracking and monitoring should be implemented to detect potential attacks. Asset inventory and exposure review should be performed to identify potential vulnerabilities. Compensating controls, such as restricting access to NTFS3 disk images, shouldbe

Technical summary

The ntfs3 driver in the Linux kernel has an unbounded free-chain walker that can be triggered by a crafted NTFS3 disk image, leading to an in-kernel infinite loop at mount time. The issue is caused by a lack of bounds checking in the check_rstbl() function. A patched version of the driver bounds the walker by rt->used, preventing the infinite loop. The vulnerability is reachable from desktop USB auto-mount on distributions where udisks2 routes the NTFS signature to the in-tree ntfs3 driver. Linux kernel developers and maintainers should review the patch and apply it to affected systems.

Defensive priority

High

Recommended defensive actions

• Inventory and assess Linux kernel installations for potential exposure.
• Apply patches or updates to the ntfs3 driver to prevent exploitation.
• Monitor for suspicious activity related to NTFS3 disk images.
• Consider implementing compensating controls, such as restricting access to NTFS3 disk images.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and NVD entry provide limited information about the vulnerability. Further analysis of the Linux kernel source code and ntfs3 driver is required to fully understand the issue. The vulnerability is caused by an unbounded free-chain walker in the ntfs3 driver, which can be triggered by a crafted NTFS3 disk image. This can lead to an in-kernel infinite loop at mount time, hanging the mounting thread and firing the soft-lockup watchdog. The issue is reachable from desktop USB auto-mount on distributions where udisks2 routes the NTFS signature to the in-tree ntfs3 driver. A patched version of the driver bounds the walker by rt->used, preventing the infinite loop. Linux kernel developers and maintainers should review the patch and apply it to affected systems. Users of Linux systems that support NTFS3 disk images should ensure that their systems are updated with the patched driver.

Official resources