CVE-2026-72211
Received Received - Intake

BaseFortify

Publication date: 2026-08-15

Last updated on: 2026-08-15

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: ntfs: grow index root value before reparent header update ntfs_ir_reparent() moves the resident index root entries into an index block and leaves a small root stub containing the child VCN. That root stub can be larger than the existing resident value. For example, an empty root with value_length 48 has an index area of 32 bytes, while the large-index root stub needs index_length and allocated_size of 40 bytes. The current code publishes the larger index.index_length and index.allocated_size before resizing the resident value. If the resize returns -ENOSPC, the recovery path can call ntfs_inode_add_attrlist(), which looks attributes up again while the root header says allocated_size 40 but the resident value still only provides 32 bytes of index area. Lookup-time $INDEX_ROOT validation then correctly rejects that transient layout as corrupt. This reproduces as a generic/013 failure under qemu. In the failing run, the transient root had value_len=48, index_size=32, index_length=40, and allocated_size=40, and ntfsprogs-plus ntfsck reported "Corrupt index root in MFT record 1177". When the root stub grows, resize the resident value before publishing the larger root header. If the resize fails, the old root remains valid for recovery lookups. Keep the existing header-before-resize ordering for shrink or same-size cases so the resident value never temporarily exposes an allocated_size beyond its bounds.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-15
Last Modified
2026-08-15
Generated
2026-08-15
AI Q&A
2026-08-15
EPSS Evaluated
N/A
NVD
CVE-2026-72211
EUVD
EUVD-2026-58969

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
ntfsprogs ntfsprogs *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves the NTFS file system. When the index root of an NTFS file grows, the code updates the header size before resizing the resident value. If the resize fails, the header claims more space than available, causing corruption during recovery. This leads to lookup-time validation errors, such as 'Corrupt index root in MFT record'.

Detection Guidance

This vulnerability is specific to the Linux kernel's NTFS filesystem handling. Detection requires checking for filesystem corruption in NTFS partitions. Use fsck.ntfs or ntfsck tools on affected volumes. For example: fsck.ntfs -f /dev/sdX1 or ntfsck /dev/sdX1 where sdX1 is your NTFS partition.

Impact Analysis

This vulnerability can cause file system corruption in NTFS partitions, leading to data loss or inability to access files. It may trigger errors during file system checks or recovery operations, potentially rendering the system unstable or unbootable.

Mitigation Strategies

Update your Linux kernel to the latest patched version. Avoid using NTFS for critical operations until patched. If you must use NTFS, ensure backups are current and test the filesystem with fsck.ntfs before and after operations.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-72211. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart