CVE-2026-72194 Linux CVE debrief

Who should care

Linux system administrators, security teams, and users of ntfs3 filesystems should be aware of this vulnerability and take steps to mitigate it. They should assess their exposure to ntfs3 filesystems, implement compensating controls, and monitor for suspicious activity related to ntfs3 filesystems. Additionally, they should apply patches or updates to the Linux kernel as they become available. The vulnerability has a high impact on system availability, and exploitation can cause a system panic, making it essential for Linux system administrators and security teams to prioritize mitigation efforts.

Technical summary

The Linux kernel's ntfs3 filesystem implementation is vulnerable to a stack overflow attack due to the lack of a depth limit in the `indx_find_buffer` function. A crafted NTFS image with circular index node references can cause a stack overflow and panic the system. This can be triggered by mounting a malicious NTFS filesystem and deleting a specific file. The vulnerability is caused by the recursive descent of the B+ tree index without a depth limit, which allows an attacker to cause a stack overflow. The affected product is the Linux kernel, and the vulnerability is related to the ntfs3 filesystem implementation.

Defensive priority

High

Recommended defensive actions

• Inventory and assess Linux systems for exposure to ntfs3 filesystems
• Implement compensating controls, such as restricting access to ntfs3 filesystems
• Monitor for suspicious activity related to ntfs3 filesystems
• Apply patches or updates to the Linux kernel as they become available
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and NVD entry provide limited information about the vulnerability. The Linux kernel's ntfs3 filesystem implementation is vulnerable to a stack overflow attack. The `indx_find_buffer` function lacks a depth limit, allowing a crafted NTFS image to cause a stack overflow. The vulnerability can be triggered by mounting a malicious NTFS filesystem and deleting a specific file.

Official resources