CVE-2026-72189 (GCVE-0-2026-72189)

Vulnerability from cvelistv5 – Published: 2026-08-15 05:53 – Updated: 2026-08-17 05:09
VLAI
Title
ntfs: fail attrlist updates when the superblock is inactive
Summary
In the Linux kernel, the following vulnerability has been resolved: ntfs: fail attrlist updates when the superblock is inactive generic_shutdown_super() clears SB_ACTIVE before evicting cached inodes. If eviction selects the fake inode for a base inode's unnamed $ATTRIBUTE_LIST attribute, ntfs_evict_big_inode() drops the fake inode's reference on the base inode while the fake inode is still hashed and marked I_FREEING. That iput can synchronously write back the base inode. The writeback path may update mapping pairs and call ntfs_attrlist_update(), which unconditionally calls ntfs_attr_iget() for the same $ATTRIBUTE_LIST fake inode. VFS then finds the I_FREEING inode and waits for eviction to finish, but the current task is still inside that eviction path, causing a self-deadlock in find_inode(). Fix this by mirroring the teardown guard used by __ntfs_write_inode(): once SB_ACTIVE has been cleared, do not try to iget the attribute-list fake inode. Return -EIO so teardown aborts the update instead of waiting on the inode it is evicting.
Severity
No CVSS data available.
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 495e90fa334828d4119061e2726af51d0a0fb4ed , < d5379035355c0dcb1e92a2544d40f48441e1d637 (git)
Affected: 495e90fa334828d4119061e2726af51d0a0fb4ed , < 0ebe8f625ab0520217a425d7cd366e4670484941 (git)
guessed Create a notification for this product.
Linux Linux Affected: 7.1
Unaffected: 0 , < 7.1 (semver)
Unaffected: 7.1.5 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/ntfs/attrlist.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "d5379035355c0dcb1e92a2544d40f48441e1d637",
              "status": "affected",
              "version": "495e90fa334828d4119061e2726af51d0a0fb4ed",
              "versionType": "git"
            },
            {
              "lessThan": "0ebe8f625ab0520217a425d7cd366e4670484941",
              "status": "affected",
              "version": "495e90fa334828d4119061e2726af51d0a0fb4ed",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/ntfs/attrlist.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "7.1"
            },
            {
              "lessThan": "7.1",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "7.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "7.1",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nntfs: fail attrlist updates when the superblock is inactive\n\ngeneric_shutdown_super() clears SB_ACTIVE before evicting cached inodes.\nIf eviction selects the fake inode for a base inode\u0027s unnamed\n$ATTRIBUTE_LIST attribute, ntfs_evict_big_inode() drops the fake inode\u0027s\nreference on the base inode while the fake inode is still hashed and marked\nI_FREEING.\n\nThat iput can synchronously write back the base inode. The writeback path\nmay update mapping pairs and call ntfs_attrlist_update(), which\nunconditionally calls ntfs_attr_iget() for the same $ATTRIBUTE_LIST fake\ninode. VFS then finds the I_FREEING inode and waits for eviction to finish,\nbut the current task is still inside that eviction path, causing a\nself-deadlock in find_inode().\n\nFix this by mirroring the teardown guard used by __ntfs_write_inode():\nonce SB_ACTIVE has been cleared, do not try to iget the attribute-list\nfake inode. Return -EIO so teardown aborts the update instead of waiting on\nthe inode it is evicting."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:09:53.903Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/d5379035355c0dcb1e92a2544d40f48441e1d637"
        },
        {
          "url": "https://git.kernel.org/stable/c/0ebe8f625ab0520217a425d7cd366e4670484941"
        }
      ],
      "title": "ntfs: fail attrlist updates when the superblock is inactive",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-72189",
    "datePublished": "2026-08-15T05:53:50.373Z",
    "dateReserved": "2026-08-09T03:40:39.911Z",
    "dateUpdated": "2026-08-17T05:09:53.903Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-72189",
      "date": "2026-09-21",
      "epss": "0.00189",
      "percentile": "0.088"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "fs/ntfs/attrlist.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "d5379035355c0dcb1e92a2544d40f48441e1d637",
                    "status": "affected",
                    "version": "495e90fa334828d4119061e2726af51d0a0fb4ed",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "0ebe8f625ab0520217a425d7cd366e4670484941",
                    "status": "affected",
                    "version": "495e90fa334828d4119061e2726af51d0a0fb4ed",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "fs/ntfs/attrlist.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "7.1"
                  },
                  {
                    "lessThan": "7.1",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.1.*",
                    "status": "unaffected",
                    "version": "7.1.5",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.2",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nntfs: fail attrlist updates when the superblock is inactive\n\ngeneric_shutdown_super() clears SB_ACTIVE before evicting cached inodes.\nIf eviction selects the fake inode for a base inode\u0027s unnamed\n$ATTRIBUTE_LIST attribute, ntfs_evict_big_inode() drops the fake inode\u0027s\nreference on the base inode while the fake inode is still hashed and marked\nI_FREEING.\n\nThat iput can synchronously write back the base inode. The writeback path\nmay update mapping pairs and call ntfs_attrlist_update(), which\nunconditionally calls ntfs_attr_iget() for the same $ATTRIBUTE_LIST fake\ninode. VFS then finds the I_FREEING inode and waits for eviction to finish,\nbut the current task is still inside that eviction path, causing a\nself-deadlock in find_inode().\n\nFix this by mirroring the teardown guard used by __ntfs_write_inode():\nonce SB_ACTIVE has been cleared, do not try to iget the attribute-list\nfake inode. Return -EIO so teardown aborts the update instead of waiting on\nthe inode it is evicting."
          }
        ],
        "id": "CVE-2026-72189",
        "lastModified": "2026-08-17T06:18:19.493",
        "metrics": {},
        "published": "2026-08-15T06:21:37.313",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/0ebe8f625ab0520217a425d7cd366e4670484941"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/d5379035355c0dcb1e92a2544d40f48441e1d637"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-17T13:43:54+00:00",
      "cve": "CVE-2026-72189",
      "id": "CVE-2026-72189",
      "initial_release_date": "2026-08-15T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: ntfs: fail attrlist updates when the superblock is inactive",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-72189.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-01T13:31:14Z",
      "cve": "CVE-2026-72189",
      "id": "CVE-2026-72189",
      "initial_release_date": "2026-09-01T13:31:14Z",
      "product_status:known_not_affected": "362",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-72189",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-72189.json",
      "version": "2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.