CVE-2026-72190

Received Received - Intake

Deadlock in Linux Kernel NTFS Filesystem

Publication date: 2026-08-15

Last updated on: 2026-08-17

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: ntfs: fix mrec_lock ABBA deadlock in rename ntfs_file_fsync(), ntfs_dir_fsync() and __ntfs_write_inode() lock an inode's mrec_lock before taking the mrec_lock of its parent directory. ntfs_rename() takes old_ni->mrec_lock and old_dir_ni->mrec_lock before taking new_ni->mrec_lock for an existing target, or new_dir_ni->mrec_lock for a cross-directory rename. This can deadlock when ntfs_file_fsync() or __ntfs_write_inode() holds the target inode, or when ntfs_dir_fsync() holds a child target directory, while rename() holds the parent directory and waits for the target. Fix this by locking the existing target inode before taking any parent directory mrec_lock. For cross-directory renames where the target parent is a descendant of the source parent, lock the target parent before the source parent so the directory order matches the child-to-parent order used by ntfs_file_fsync(), ntfs_dir_fsync(), and __ntfs_write_inode().

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-17

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-72190

EUVD

EUVD-2026-58948

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability is a deadlock issue in the Linux kernel's NTFS file system driver. It occurs during file or directory renames when multiple processes attempt to lock inodes in conflicting orders. Specifically, the fsync operations (ntfs_file_fsync, ntfs_dir_fsync) and inode write operations (__ntfs_write_inode) lock an inode before its parent directory, while the rename operation (ntfs_rename) locks parent directories before the target inode. This can cause a deadlock if the rename operation holds a parent directory lock while waiting for a target inode lock held by another process.

Detection Guidance

This vulnerability is specific to the Linux kernel's NTFS filesystem implementation and involves a deadlock in the mrec_lock mechanism during file operations. Detection requires checking kernel logs for deadlock warnings or hangs during NTFS file operations, especially during rename operations. Use dmesg or journalctl to review kernel logs for lock-related errors or warnings.

Impact Analysis

This vulnerability can cause system hangs or freezes when performing file or directory rename operations on an NTFS file system. If a deadlock occurs, the affected processes may become unresponsive, requiring a system reboot to recover. It primarily affects systems using NTFS file systems where multiple processes are performing fsync operations and renames simultaneously.

Compliance Impact

This vulnerability does not directly affect compliance with standards like GDPR or HIPAA as it is a local filesystem deadlock issue in the Linux kernel's NTFS driver. It does not involve data exposure, unauthorized access, or integrity violations that these regulations typically address.

Mitigation Strategies

Apply the kernel patch that resolves this issue. Update your Linux kernel to a version that includes the fix for CVE-2026-72190. Avoid performing concurrent NTFS rename operations on the same filesystem to reduce the risk of deadlocks until the patch is applied.

Hi! I’m here to help you understand CVE-2026-72190. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70