CVE-2026-72207 (GCVE-0-2026-72207)

Vulnerability from cvelistv5 – Published: 2026-08-15 05:54 – Updated: 2026-08-18 06:56
VLAI
Title
ntfs: not change 0-byte $DATA attribute to non-resident
Summary
In the Linux kernel, the following vulnerability has been resolved: ntfs: not change 0-byte $DATA attribute to non-resident When ntfs_resident_attr_resize() cannot grow a resident attribute in place, it retries after converting other resident attributes to non-resident to free space in the MFT recrord. Do not select zero-length resident $DATA attributes for this conversion. fsck treats 0-byte non-resident $DATA attribute as corruptions.
Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 495e90fa334828d4119061e2726af51d0a0fb4ed , < ceb49c37250125d418410988f2376ed4d57a6706 (git)
Affected: 495e90fa334828d4119061e2726af51d0a0fb4ed , < 0aad21570197973af4a1b25b3fb8ed3aeb9e7670 (git)
guessed Create a notification for this product.
Linux Linux Affected: 7.1
Unaffected: 0 , < 7.1 (semver)
Unaffected: 7.1.5 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/ntfs/attrib.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "ceb49c37250125d418410988f2376ed4d57a6706",
              "status": "affected",
              "version": "495e90fa334828d4119061e2726af51d0a0fb4ed",
              "versionType": "git"
            },
            {
              "lessThan": "0aad21570197973af4a1b25b3fb8ed3aeb9e7670",
              "status": "affected",
              "version": "495e90fa334828d4119061e2726af51d0a0fb4ed",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/ntfs/attrib.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "7.1"
            },
            {
              "lessThan": "7.1",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "7.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "7.1",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nntfs: not change 0-byte $DATA attribute to non-resident\n\nWhen ntfs_resident_attr_resize() cannot grow a resident attribute in\nplace, it retries after converting other resident attributes to\nnon-resident to free space in the MFT recrord.\n\nDo not select zero-length resident $DATA attributes for this conversion.\nfsck treats 0-byte non-resident $DATA attribute as corruptions."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - ntfs_resident_attr_resize() is reached from VFS write/truncate/fallocate paths (ntfs_attr_expand, __ntfs_attr_truncate_vfs); fs/ntfs registers ntfs_export_ops, so remote NFS or ksmbd clients writing to an exported rw NTFS share can trigger the corrupting conversion without local shell access.\nAC:L - An attacker can deterministically pack an MFT record with a resident 0-byte $DATA attribute plus other resident attributes, then grow a different resident attribute to force -ENOSPC and select that $DATA for conversion; no races or victim-specific memory layout are required.\nPR:N - Exploitation requires only permission to write or truncate files on a mounted NTFS volume (local user with directory write access, authenticated SMB/NFS client, or guest/anonymous write on a misconfigured export); mounting is environmental setup, not a privilege needed during the trigger.\nUI:N - Once an administrator has rw-mounted and optionally exported the NTFS volume (or automounted dual-boot/shared storage), the attacker drives write/truncate operations that exhaust MFT record space; no further victim clicks, opens, or cooperative actions are required beyond that standing configuration.\nS:U - Impact is confined to on-disk NTFS $DATA metadata corruption and subsequent filesystem operation failure within the host kernel/filesystem security authority; this is standard local or network filesystem exploitation, not a VM escape or cross-authority sandbox breakout.\nC:H - Converting a 0-byte resident $DATA to non-resident writes structurally invalid on-disk metadata that ntfsck/fsck treat as corruption; subsequent attribute lookups and data reads on the affected inode parse attacker-influenced corrupt non-resident layout and may read beyond intended attribute bounds.\nI:H - The bug persistently corrupts MFT $DATA records by creating invalid 0-byte non-resident attributes, enabling attacker-steerable on-disk metadata modification beyond the intended filesystem state that repair tools flag as corruption and that can render affected files or volumes inconsistent across OSes.\nA:H - Corrupt 0-byte non-resident $DATA attributes cause fsck/ntfsck failures and can leave affected files or volumes unusable on remount or when accessed from Windows or Linux; persistent on-disk corruption that blocks reliable filesystem access scores Availability High."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-18T06:56:27.219Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/ceb49c37250125d418410988f2376ed4d57a6706"
        },
        {
          "url": "https://git.kernel.org/stable/c/0aad21570197973af4a1b25b3fb8ed3aeb9e7670"
        }
      ],
      "title": "ntfs: not change 0-byte $DATA attribute to non-resident",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-72207",
    "datePublished": "2026-08-15T05:54:03.281Z",
    "dateReserved": "2026-08-09T03:40:39.912Z",
    "dateUpdated": "2026-08-18T06:56:27.219Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-72207",
      "date": "2026-09-21",
      "epss": "0.00516",
      "percentile": "0.42776"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "fs/ntfs/attrib.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "ceb49c37250125d418410988f2376ed4d57a6706",
                    "status": "affected",
                    "version": "495e90fa334828d4119061e2726af51d0a0fb4ed",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "0aad21570197973af4a1b25b3fb8ed3aeb9e7670",
                    "status": "affected",
                    "version": "495e90fa334828d4119061e2726af51d0a0fb4ed",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "fs/ntfs/attrib.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "7.1"
                  },
                  {
                    "lessThan": "7.1",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.1.*",
                    "status": "unaffected",
                    "version": "7.1.5",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.2",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nntfs: not change 0-byte $DATA attribute to non-resident\n\nWhen ntfs_resident_attr_resize() cannot grow a resident attribute in\nplace, it retries after converting other resident attributes to\nnon-resident to free space in the MFT recrord.\n\nDo not select zero-length resident $DATA attributes for this conversion.\nfsck treats 0-byte non-resident $DATA attribute as corruptions."
          }
        ],
        "id": "CVE-2026-72207",
        "lastModified": "2026-08-18T07:16:54.060",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 9.8,
                "baseSeverity": "CRITICAL",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-08-15T06:21:39.417",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/0aad21570197973af4a1b25b3fb8ed3aeb9e7670"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/ceb49c37250125d418410988f2376ed4d57a6706"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-18T16:28:43+00:00",
      "cve": "CVE-2026-72207",
      "id": "CVE-2026-72207",
      "initial_release_date": "2026-08-15T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: ntfs: not change 0-byte $DATA attribute to non-resident",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-72207.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-21T00:42:33Z",
      "cve": "CVE-2026-72207",
      "id": "CVE-2026-72207",
      "initial_release_date": "2026-08-21T00:42:33Z",
      "product_status:known_not_affected": "284",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-72207",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-72207.json",
      "version": "2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.