CVE-2026-72189
Received Received - Intake

Linux kernel NTFS attribute list update failure

Publication date: 2026-08-15

Last updated on: 2026-08-15

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: ntfs: fail attrlist updates when the superblock is inactive generic_shutdown_super() clears SB_ACTIVE before evicting cached inodes. If eviction selects the fake inode for a base inode's unnamed $ATTRIBUTE_LIST attribute, ntfs_evict_big_inode() drops the fake inode's reference on the base inode while the fake inode is still hashed and marked I_FREEING. That iput can synchronously write back the base inode. The writeback path may update mapping pairs and call ntfs_attrlist_update(), which unconditionally calls ntfs_attr_iget() for the same $ATTRIBUTE_LIST fake inode. VFS then finds the I_FREEING inode and waits for eviction to finish, but the current task is still inside that eviction path, causing a self-deadlock in find_inode(). Fix this by mirroring the teardown guard used by __ntfs_write_inode(): once SB_ACTIVE has been cleared, do not try to iget the attribute-list fake inode. Return -EIO so teardown aborts the update instead of waiting on the inode it is evicting.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-15
Last Modified
2026-08-15
Generated
2026-08-15
AI Q&A
2026-08-15
EPSS Evaluated
N/A
NVD
CVE-2026-72189
EUVD
EUVD-2026-58947

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Linux kernel vulnerability where a deadlock occurs during filesystem teardown. When the superblock becomes inactive, the system tries to update attribute lists on an inode that is already being evicted. This causes a self-deadlock because the eviction process cannot complete while waiting for the same operation it is performing.

Detection Guidance

This vulnerability is specific to the Linux kernel's NTFS filesystem handling. Detection requires checking kernel logs for filesystem errors or deadlocks related to NTFS operations. Monitor for messages like 'self-deadlock' or 'I_FREEING inode' during NTFS operations. Use commands like dmesg | grep -i ntfs or journalctl -k | grep -i ntfs to inspect kernel logs for suspicious activity.

Impact Analysis

This vulnerability could cause system hangs or crashes during filesystem operations, particularly when dealing with NTFS filesystems. It may lead to data corruption or denial of service if the deadlock occurs during critical operations.

Mitigation Strategies

Apply the latest Linux kernel patches to resolve this issue. Avoid mounting or using NTFS filesystems until the system is updated. If NTFS usage is unavoidable, consider temporarily switching to an alternative filesystem like ext4. Monitor system stability and kernel logs for signs of the vulnerability after patching.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-72189. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart