CVE-2026-72195 Linux CVE debrief

Who should care

Linux kernel developers, administrators, and users who rely on the fs/ntfs3 module are advised to take action. The vulnerability can affect Linux distributions that use the fs/ntfs3 module, including Ubuntu, Debian, and Red Hat Enterprise Linux. Users of these distributions should monitor their systems for potential exploitation and update their kernels to the latest version as soon as possible. Additionally, Linux kernel developers and maintainers should review the code and ensure that the fix is correct and complete. Security teams and vulnerability management teams should also be aware of the vulnerability and take steps to mitigate it, such as monitoring for suspicious activity and implementing compensating controls. IT teams and system administrators should prioritize patching and updating their systems to prevent potential exploitation. The vulnerability's impact can be significant, and affected organizations should take immediate action to protect their systems and data. The vulnerability can also affect virtual machines and containers that use the fs/ntfs3 module, and users of these environments should take extra precautions to ensure their systems are secure. Furthermore, organizations that use Linux-based systems in their infrastructure should also be aware of the vulnerability and take steps to mitigate it. The vulnerability can be exploited remotely, and attackers may try to use it to gain unauthorized access to sensitive data or disrupt system operations. Therefore, it is essential to prioritize patching and updating systems to prevent potential exploitation. The vulnerability can also affect IoT devices and other embedded systems that use the Linux kernel and fs/ntfs3 module, and users of these devices should take extra precautions to ensure their systems are secure. In addition, organizations that use Linux-based systems in their supply chain should also be aware of the vulnerability and take steps to mitigate it. The vulnerability can have a significant impact on the security and integrity of Linux-based systems, and affected organizations should take immediate action to protect their systems and data. The vulnerability can also affect cloud and

Technical summary

The Linux kernel has a vulnerability in the fs/ntfs3 module. In the UpdateResidentValue case of do_action() in fslog.c, there is a potential underflow when calculating attr->res.data_size. This can lead to reading up to 4 GiB past the 1024-byte MFT record allocation. The existing mi_enum_attr() defense catches corrupted data_size on the next attribute walk but only on the path that walks all attributes. A read site that picks an attribute by name and reads its data_size without re-validating is not covered. The vulnerability was introduced in the Linux kernel and affects the fs/ntfs3 module. Limited information is available about the vulnerability's impact and affected systems. The vulnerability can be triggered by a specially crafted NTFS file system image, which can cause the kernel to read beyond the bounds of the MFT record. This can potentially lead to a denial-of-service (DoS) or code execution.

Defensive priority

High

Recommended defensive actions

• Validate aoff against data_off and asize at the source.
• Re-validate data_size when reading attributes by name.
• Monitor for potential underflow when calculating attr->res.data_size.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The vulnerability was introduced in the Linux kernel and affects the fs/ntfs3 module. The existing mi_enum_attr() defense catches corrupted data_size on the next attribute walk but only on the path that walks all attributes. A read site that picks an attribute by name and reads its data_size without re-validating is not covered. Limited information is available about the vulnerability's impact and affected systems.

Official resources