CVE-2026-72200

Received Received - Intake

NTFS Runlist LCN Overflow Vulnerability

Publication date: 2026-08-15

Last updated on: 2026-08-19

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: ntfs: detect mapping-pairs LCN accumulator overflow The NTFS mapping-pairs parser accumulates relative LCN deltas in a signed integer. A corrupted attribute can drive that addition past the representable range. One corrupt runlist shape sets the accumulated LCN to S64_MAX and then adds a delta of 1 in the next mapping-pairs entry. Signed overflow is undefined and can turn an invalid runlist into a different set of physical clusters. Check the LCN addition for overflow before storing the next run.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-19

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-72200

EUVD

EUVD-2026-58958

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves the NTFS file system's mapping-pairs parser. It occurs when the parser accumulates relative LCN (Logical Cluster Number) deltas in a signed integer. A corrupted attribute can cause this integer to overflow past its maximum representable value, leading to undefined behavior. Specifically, a corrupt runlist can set the LCN to the maximum value and then add 1, causing signed overflow which may transform an invalid runlist into a different set of physical clusters.

The fix involves checking the LCN addition for overflow before storing the next run to prevent this issue.

Detection Guidance

This vulnerability is specific to the Linux kernel's NTFS file system driver. Detection requires checking for corrupted NTFS runlists that could trigger the LCN accumulator overflow. Use kernel logs for errors related to NTFS parsing or filesystem corruption. Commands like dmesg | grep -i ntfs or journalctl -k | grep -i ntfs may help identify issues.

Impact Analysis

This vulnerability could allow an attacker with access to craft a malicious NTFS file system to cause undefined behavior in the kernel. This might lead to system crashes, data corruption, or unexpected behavior. If exploited, it could compromise the integrity of the file system and potentially allow unauthorized access to data.

Compliance Impact

This vulnerability does not directly affect compliance with standards like GDPR or HIPAA as it is a low-level kernel issue in the NTFS filesystem driver. It could potentially lead to data corruption or unauthorized access if exploited, which might indirectly impact compliance by compromising data integrity or security.

Mitigation Strategies

Update your Linux kernel to the latest stable version that includes the fix for this NTFS vulnerability. Avoid mounting untrusted NTFS filesystems until patched. If you cannot update immediately, disable NTFS support or restrict access to NTFS volumes until mitigation is applied.

Hi! I’m here to help you understand CVE-2026-72200. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70