CVE-2026-72478 Linux CVE debrief

Who should care

Linux kernel developers and users, as well as anyone responsible for maintaining and securing Linux-based systems, should be aware of this vulnerability. The vulnerability affects the fs/ntfs3 module in the Linux kernel, and defenders should review and apply the patch to prevent potential exploitation. Additionally, defenders should monitor the Linux kernel for any similar vulnerabilities in the future and review compensating controls for exposed systems while remediation is scheduled and verified.

Technical summary

The run_get_highest_vcn() function in the Linux kernel's fs/ntfs3 module does not perform bounds checking on a packed NTFS mapping-pairs buffer. This can lead to a slab-out-of-bounds read when a crafted $LogFile UpdateMappingPairs record is encountered. The vulnerability has been resolved by adding a bounds check to the function. The affected product is the Linux kernel, and the vulnerability has a medium defensive priority. Defenders should review and apply the patch to the Linux kernel and ensure that the Linux kernel is updated to a version that includes the patch.

Defensive priority

Medium

Recommended defensive actions

• Review and apply the patch to the Linux kernel
• Ensure the Linux kernel is updated to a version that includes the patch
• Monitor the Linux kernel for any similar vulnerabilities
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability was discovered in the Linux kernel's fs/ntfs3 module. The run_get_highest_vcn() function did not perform bounds checking on a packed NTFS mapping-pairs buffer, leading to a slab-out-of-bounds read. The vulnerability has been resolved by adding a bounds check to the function. Evidence of this vulnerability is limited, and defenders should verify the Linux kernel version and ensure that the patch has been applied. Additional verification tasks include reviewing system logs for potential exploitation attempts and monitoring for similar vulnerabilities in the future.

Official resources