CVE-2026-72203 Linux CVE debrief

Who should care

Linux kernel developers, administrators, and users of systems with ntfs filesystems should be aware of this vulnerability. They should assess their exposure, apply patches or updates, and monitor for potential exploitation attempts. Security teams and vulnerability management teams should prioritize patching and review compensating controls for exposed systems.

Technical summary

The Linux kernel's ntfs filesystem implementation was vulnerable to a deadlock condition. The ABBA deadlock between extent_lock and extent mrec_lock was triggered by xfstests generic/113. A patch was applied to remove all extent_lock and extent mrec_lock acquisition from the MFT folio writeback path, eliminating the deadlock. This patch prevents potential deadlocks that could occur during writeback operations on ntfs filesystems.

Defensive priority

Medium

Recommended defensive actions

• Inventory and assess Linux kernel installations for exposure
• Apply vendor patches or updates to address the vulnerability
• Monitor for potential exploitation attempts
• Consider compensating controls, such as restricting access to sensitive areas
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

Evidence is limited; primary official records indicate a patch was applied to resolve an ABBA deadlock in the Linux kernel's ntfs filesystem implementation. The issue was triggered by xfstests generic/113. Limited evidence suggests that the patch removes all extent_lock and extent mrec_lock acquisition from the MFT folio writeback path, eliminating the deadlock. Defenders should verify the patch application and test for potential exposure.

Official resources