CVE-2026-72199
Description
A flaw was found in the NTFS filesystem driver of the Linux kernel. This vulnerability arises from insufficient validation of resident index root values during lookup operations. An attacker could potentially craft a malicious NTFS filesystem that, when processed by the kernel, leads to inconsistent internal data structures. This could result in system instability or a denial of service (DoS) condition.
Statement
This moderate impact flaw is in the NTFS filesystem driver of the Linux kernel. Resident $INDEX_ROOT values carry index header fields (such as entries_offset, index_length, and allocated_size) that callers consume after lookup, but the existing validation was scattered and did not cover all root header invariants. A local attacker with the ability to process a specially crafted NTFS filesystem could cause the kernel to operate on inconsistent internal data structures, resulting in system instability or a denial of service. Red Hat rates this flaw as moderate (CVSS 3.1: AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) because exploitation requires local access with privileges and the impact is limited to availability; this differs significantly from the upstream CVEORG critical score of 9.8, which assumes a network attack vector without privileges and high confidentiality and integrity impacts that the flaw's technical nature does not support. All Red Hat products currently in scope for this flaw, including the Red Hat Enterprise Linux and Red Hat In-Vehicle OS kernel and kernel-rt components, are not affected because the vulnerable code is not present in the shipped kernels.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.5 | N/A | 9.8 |
| Attack Vector | Local | N/A | Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | Low | N/A | None |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | None | N/A | High |
| Integrity Impact | None | N/A | High |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
cve.org: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Understanding the Weakness (CWE)
Other
Technical Impact: Varies by Context
When complex inputs are inconsistent, attackers could trigger unexpected errors, cause incorrect actions to take place, or exploit latent vulnerabilities.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
