CVE-2026-72194

Received Received - Intake

Stack Overflow in Linux Kernel NTFS3 Driver

Publication date: 2026-08-15

Last updated on: 2026-08-17

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: add depth limit to indx_find_buffer to prevent stack overflow indx_find_buffer() recursively descends the B+ tree index with no depth limit. A crafted NTFS image with circular index node references causes unbounded recursion, overflowing the kernel stack and panicking the system. This is reachable by mounting a malicious NTFS filesystem (e.g. from a USB drive via desktop automount) and deleting a file whose index entry triggers the rebalancing fallback path in indx_delete_entry(). Add a depth parameter and bail out with -EINVAL when it reaches the fnd->nodes array bound, matching the constraint already enforced by fnd_push() in indx_find(). The related function indx_find() was previously patched for a similar infinite-loop issue (commit 1732053c8a6b), but indx_find_buffer() was missed.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-17

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-72194

EUVD

EUVD-2026-58952

Affected Vendors & Products

Vendor	Product	Version / Range
linux	kernel	*
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a stack overflow vulnerability in the Linux kernel's NTFS3 filesystem driver. It occurs when the indx_find_buffer() function recursively processes a B+ tree index in an NTFS filesystem without checking recursion depth. A specially crafted NTFS image with circular references causes infinite recursion, leading to kernel stack overflow and system crash.

Detection Guidance

This vulnerability is triggered by mounting a malicious NTFS filesystem and performing specific file operations. Detection requires inspecting kernel logs for stack overflow errors or system panics related to NTFS operations. Check for crashes after mounting NTFS volumes or during file deletions.

Impact Analysis

If you mount a malicious NTFS filesystem (e.g., from a USB drive), an attacker could trigger this flaw by deleting a file that causes index rebalancing. This would crash your system, potentially causing data loss or denial of service. Desktop automount features make this easier to exploit.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It is a local denial-of-service issue in the Linux kernel's NTFS3 filesystem driver, causing system crashes via crafted filesystems. Compliance impacts would only occur if the vulnerability leads to unauthorized data access or service disruption in regulated environments.

Mitigation Strategies

Apply the latest Linux kernel security patches to address the indx_find_buffer() depth limit issue. Avoid mounting untrusted NTFS filesystems until patched. Monitor system logs for NTFS-related crashes or stack overflow errors.

Hi! I’m here to help you understand CVE-2026-72194. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70