CVE-2026-72202 Linux CVE debrief

Who should care

Linux kernel developers and maintainers, as well as users of Linux-based systems, should be aware of this vulnerability and take steps to ensure their systems are updated with the patch. Additionally, security teams and vulnerability management teams should review the vulnerability and assess their exposure to it.

Technical summary

The Linux kernel vulnerability CVE-2026-72202 relates to the handling of ntfs free-cluster readahead state. The issue arises when get_nr_free_clusters() fails to allocate a temporary file_ra_state, causing the worker to return without setting the flag or waking waiters. This can lead to callers waiting for the free count to block indefinitely. The vulnerability has been resolved by keeping the readahead state on the stack and passing it by address to the readahead helper.

Defensive priority

Medium

Recommended defensive actions

• Review and apply the patch to ensure the vulnerability is resolved
• Monitor Linux kernel updates for further information
• Verify system configurations to prevent exploitation
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability CVE-2026-72202 is related to the Linux kernel's handling of ntfs free-cluster readahead state. The issue arises when get_nr_free_clusters() fails to allocate a temporary file_ra_state, causing the worker to return without setting the flag or waking waiters. This can lead to callers waiting for the free count to block indefinitely. To verify, defenders should review the Linux kernel source code, specifically the ntfs implementation, and check for the presence of the patch. Additionally, they should monitor for potential exploitation attempts and review system configurations to prevent exploitation.

Official resources