CVE-2026-72188

Received Received - Intake

NTFS MFT Reference Validation Flaw in Linux Kernel

Publication date: 2026-08-15

Last updated on: 2026-08-17

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: ntfs: sanitize MFT references returned from ntfs_lookup_inode_by_name() ntfs_lookup_inode_by_name() returns MFT references read from directory index entries on disk. These values are untrusted, but the function can currently return an error-marked MFT reference to its callers without validating it. Callers later decode lookup failures with MREF_ERR(). A crafted NTFS image can set the MREF error bit while leaving the low bits as an arbitrary value, causing callers to consume a bogus pseudo-errno instead of treating the lookup result as corrupted on-disk metadata. Fix this at the source by normalizing every error-marked MFT reference returned from ntfs_lookup_inode_by_name() to ERR_MREF(-EIO). Apply this to all four directory lookup return paths so every caller gets a validated result without needing additional checks or an API change. This keeps the sanitization in the common lookup helper, which is cleaner than duplicating validation in each caller.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-17

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-72188

EUVD

EUVD-2026-58946

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	to 416baaa9-dc9f-4396-8d5f-8c081fb06d67 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability is in the Linux kernel's NTFS file system driver. The function ntfs_lookup_inode_by_name() returns MFT references from directory entries without proper validation. A crafted NTFS image can manipulate these references to set an error bit while leaving other bits as arbitrary values, causing callers to receive fake error codes instead of recognizing corrupted metadata.

Detection Guidance

This vulnerability is specific to the Linux kernel's NTFS filesystem handling. Detection requires checking if your system is running a vulnerable kernel version. Use uname -a to check the kernel version and compare it against patched versions. Inspect NTFS-related logs for filesystem errors or crashes.

Impact Analysis

This could allow an attacker with access to craft a malicious NTFS image to cause denial of service or potentially execute arbitrary code in the kernel by tricking the system into processing invalid MFT references as valid error codes.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It is a Linux kernel NTFS filesystem issue that could lead to memory corruption or crashes if exploited, but no evidence suggests it impacts data privacy or security controls required by these regulations.

Mitigation Strategies

Update your Linux kernel to the latest stable version that includes the fix for CVE-2026-72188. Avoid mounting untrusted NTFS images until the system is patched. Monitor kernel logs for NTFS-related errors as a potential indicator of exploitation.

Hi! I’m here to help you understand CVE-2026-72188. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70