CVE-2026-72196 Linux CVE debrief

Who should care

Linux kernel developers and users who rely on the ntfs3 filesystem should be aware of this vulnerability. They should review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance. Ensure the Linux kernel is updated with the latest security patches and monitor the Linux kernel's ntfs3 filesystem for potential malicious activity. This includes reviewing compensating controls for exposed systems while remediation is scheduled and verified, checking relevant monitoring, detection, and logs for exposed assets that need extra review, and tracking exceptions, retesting remediated assets, and closing the item only after evidence is documented. Affected product deployments in managed environments should be confirmed and assigned an owner for follow-up. Security teams should prioritize patching and vulnerability management for this issue due to its potential impact on system security and stability. Additionally, platform operators and vulnerability management teams should assess their exposure and plan for updates or mitigations through normal change control where exposure is confirmed. This requires coordination with asset inventory management and change management processes to ensure timely and effective remediation. Security teams should also review the CVE record and NVD details for further guidance on affected versions and potential mitigations. Overall, a broad range of stakeholders, from developers to security teams and system administrators, should be aware of and take action regarding this vulnerability. This includes ensuring that appropriate defensive measures are in place, such as monitoring and compensating controls, while patches are being applied. The vulnerability's impact on system security and stability necessitates prompt attention and action from all relevant parties. Linux distributions and vendors should also be aware of this issue and provide guidance to their users on how to address it. In summary, anyone involved in Linux kernel development, deployment, or security should be aware of and address this vulnerability promptly and thoroughly. The vulnerability's severity and potential impact underscore,

Technical summary

The vulnerability exists in the Linux kernel's ntfs3 filesystem, specifically in the log_replay function's analysis pass. The issue arises from an unbounded copy operation that can lead to an overflow of the dp->page_lcns[] array. The fix adds a missing j + lrh->lcns_follow <= dp->lcns_follow guard to prevent the out-of-bounds write. This issue is related to but distinct from a separate patch addressing the version-0 dirty-page-table conversion path's memmove(&dp->vcn, ...) call. The two fixes are complementary; both should land. Affected Linux kernel developers should review and apply the patch to prevent potential malicious activity.

Defensive priority

High

Recommended defensive actions

• Apply the kernel patch to add the missing j + lrh->lcns_follow <= dp->lcns_follow guard.
• Ensure the Linux kernel is updated with the latest security patches.
• Monitor the Linux kernel's ntfs3 filesystem for potential malicious activity.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Review compensating controls for exposed systems while remediation is scheduled and verified.

Evidence notes

The vulnerability was discovered and resolved in the Linux kernel. The fix adds a missing j + lrh->lcns_follow <= dp->lcns_follow guard to prevent the out-of-bounds write. The issue is distinct from a separate patch addressing the version-0 dirty-page-table conversion path's memmove(&dp->vcn, ...) call.

Official resources