CVE-2026-72190 (GCVE-0-2026-72190)

Vulnerability from cvelistv5 – Published: 2026-08-15 05:53 – Updated: 2026-08-17 05:09
VLAI
Title
ntfs: fix mrec_lock ABBA deadlock in rename
Summary
In the Linux kernel, the following vulnerability has been resolved: ntfs: fix mrec_lock ABBA deadlock in rename ntfs_file_fsync(), ntfs_dir_fsync() and __ntfs_write_inode() lock an inode's mrec_lock before taking the mrec_lock of its parent directory. ntfs_rename() takes old_ni->mrec_lock and old_dir_ni->mrec_lock before taking new_ni->mrec_lock for an existing target, or new_dir_ni->mrec_lock for a cross-directory rename. This can deadlock when ntfs_file_fsync() or __ntfs_write_inode() holds the target inode, or when ntfs_dir_fsync() holds a child target directory, while rename() holds the parent directory and waits for the target. Fix this by locking the existing target inode before taking any parent directory mrec_lock. For cross-directory renames where the target parent is a descendant of the source parent, lock the target parent before the source parent so the directory order matches the child-to-parent order used by ntfs_file_fsync(), ntfs_dir_fsync(), and __ntfs_write_inode().
Severity
No CVSS data available.
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: af0db57d4293cc9fe6ce99fb5592dc2652228c9d , < b3d09502b80dfe0bab9090ca532710da389f6c7f (git)
Affected: af0db57d4293cc9fe6ce99fb5592dc2652228c9d , < eb94f5a41a193a425e09a63cb75dffd151d8f42e (git)
guessed Create a notification for this product.
Linux Linux Affected: 7.1
Unaffected: 0 , < 7.1 (semver)
Unaffected: 7.1.5 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/ntfs/namei.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "b3d09502b80dfe0bab9090ca532710da389f6c7f",
              "status": "affected",
              "version": "af0db57d4293cc9fe6ce99fb5592dc2652228c9d",
              "versionType": "git"
            },
            {
              "lessThan": "eb94f5a41a193a425e09a63cb75dffd151d8f42e",
              "status": "affected",
              "version": "af0db57d4293cc9fe6ce99fb5592dc2652228c9d",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/ntfs/namei.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "7.1"
            },
            {
              "lessThan": "7.1",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "7.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "7.1",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nntfs: fix mrec_lock ABBA deadlock in rename\n\nntfs_file_fsync(), ntfs_dir_fsync() and __ntfs_write_inode() lock an\ninode\u0027s mrec_lock before taking the mrec_lock of its parent directory.\n\nntfs_rename() takes old_ni-\u003emrec_lock and old_dir_ni-\u003emrec_lock\nbefore taking new_ni-\u003emrec_lock for an existing target, or\nnew_dir_ni-\u003emrec_lock for a cross-directory rename.\nThis can deadlock when ntfs_file_fsync() or __ntfs_write_inode() holds\nthe target inode, or when ntfs_dir_fsync() holds a child target\ndirectory, while rename() holds the parent directory and waits for the\ntarget.\n\nFix this by locking the existing target inode before taking any parent\ndirectory mrec_lock. For cross-directory renames where the target parent\nis a descendant of the source parent, lock the target parent before the\nsource parent so the directory order matches the child-to-parent order used\nby ntfs_file_fsync(), ntfs_dir_fsync(), and __ntfs_write_inode()."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:09:55.301Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/b3d09502b80dfe0bab9090ca532710da389f6c7f"
        },
        {
          "url": "https://git.kernel.org/stable/c/eb94f5a41a193a425e09a63cb75dffd151d8f42e"
        }
      ],
      "title": "ntfs: fix mrec_lock ABBA deadlock in rename",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-72190",
    "datePublished": "2026-08-15T05:53:51.143Z",
    "dateReserved": "2026-08-09T03:40:39.911Z",
    "dateUpdated": "2026-08-17T05:09:55.301Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-72190",
      "date": "2026-09-21",
      "epss": "0.00189",
      "percentile": "0.08837"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "fs/ntfs/namei.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "b3d09502b80dfe0bab9090ca532710da389f6c7f",
                    "status": "affected",
                    "version": "af0db57d4293cc9fe6ce99fb5592dc2652228c9d",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "eb94f5a41a193a425e09a63cb75dffd151d8f42e",
                    "status": "affected",
                    "version": "af0db57d4293cc9fe6ce99fb5592dc2652228c9d",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "fs/ntfs/namei.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "7.1"
                  },
                  {
                    "lessThan": "7.1",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.1.*",
                    "status": "unaffected",
                    "version": "7.1.5",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.2",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nntfs: fix mrec_lock ABBA deadlock in rename\n\nntfs_file_fsync(), ntfs_dir_fsync() and __ntfs_write_inode() lock an\ninode\u0027s mrec_lock before taking the mrec_lock of its parent directory.\n\nntfs_rename() takes old_ni-\u003emrec_lock and old_dir_ni-\u003emrec_lock\nbefore taking new_ni-\u003emrec_lock for an existing target, or\nnew_dir_ni-\u003emrec_lock for a cross-directory rename.\nThis can deadlock when ntfs_file_fsync() or __ntfs_write_inode() holds\nthe target inode, or when ntfs_dir_fsync() holds a child target\ndirectory, while rename() holds the parent directory and waits for the\ntarget.\n\nFix this by locking the existing target inode before taking any parent\ndirectory mrec_lock. For cross-directory renames where the target parent\nis a descendant of the source parent, lock the target parent before the\nsource parent so the directory order matches the child-to-parent order used\nby ntfs_file_fsync(), ntfs_dir_fsync(), and __ntfs_write_inode()."
          }
        ],
        "id": "CVE-2026-72190",
        "lastModified": "2026-08-17T06:18:19.580",
        "metrics": {},
        "published": "2026-08-15T06:21:37.430",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/b3d09502b80dfe0bab9090ca532710da389f6c7f"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/eb94f5a41a193a425e09a63cb75dffd151d8f42e"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-17T12:56:12+00:00",
      "cve": "CVE-2026-72190",
      "id": "CVE-2026-72190",
      "initial_release_date": "2026-08-15T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: ntfs: fix mrec_lock ABBA deadlock in rename",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-72190.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-01T13:31:12Z",
      "cve": "CVE-2026-72190",
      "id": "CVE-2026-72190",
      "initial_release_date": "2026-09-01T13:31:12Z",
      "product_status:known_not_affected": "362",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-72190",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-72190.json",
      "version": "2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.