CVE-2026-72189
Description
A flaw was found in the Linux kernel's NTFS file system. During the process of shutting down a file system, a specific internal condition can arise where the system attempts to update an attribute list while an associated inode is being evicted. This can lead to a self-deadlock within the kernel's inode management, causing the system to become unresponsive. The primary consequence of this vulnerability is a Denial of Service (DoS), where the affected system ceases to function.
Statement
A moderate severity denial-of-service flaw was found in the Linux kernel's NTFS file system driver. During file system shutdown, when eviction of the fake inode backing a base inode's unnamed $ATTRIBUTE_LIST attribute triggers synchronous writeback of the base inode, the writeback path may attempt to update the attribute list and look up the same fake inode while it is still being evicted. This causes a self-deadlock in the kernel's inode management, leaving the system unresponsive. Exploitation requires local access to a system running the vulnerable NTFS code, and the primary consequence is a denial of service. Red Hat rated this flaw as Moderate severity (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). All Red Hat Enterprise Linux and Red Hat In-Vehicle OS kernel streams are listed as not affected because the vulnerable NTFS code is not present in the shipped Red Hat kernels; this issue affects the upstream kernel code only.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.5 | N/A | N/A |
| Attack Vector | Local | N/A | N/A |
| Attack Complexity | Low | N/A | N/A |
| Privileges Required | Low | N/A | N/A |
| User Interaction | None | N/A | N/A |
| Scope | Unchanged | N/A | N/A |
| Confidentiality | None | N/A | N/A |
| Integrity Impact | None | N/A | N/A |
| Availability Impact | High | N/A | N/A |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Understanding the Weakness (CWE)
Availability
Technical Impact: DoS: Resource Consumption (CPU); DoS: Resource Consumption (Other); DoS: Crash, Exit, or Restart
Each thread of execution will "hang" and prevent tasks from completing. In some cases, CPU consumption may occur if a lock check occurs in a tight loop.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
