CVE-2026-72188 (GCVE-0-2026-72188)

Vulnerability from cvelistv5 – Published: 2026-08-15 05:53 – Updated: 2026-08-17 05:41
VLAI
Title
ntfs: sanitize MFT references returned from ntfs_lookup_inode_by_name()
Summary
In the Linux kernel, the following vulnerability has been resolved: ntfs: sanitize MFT references returned from ntfs_lookup_inode_by_name() ntfs_lookup_inode_by_name() returns MFT references read from directory index entries on disk. These values are untrusted, but the function can currently return an error-marked MFT reference to its callers without validating it. Callers later decode lookup failures with MREF_ERR(). A crafted NTFS image can set the MREF error bit while leaving the low bits as an arbitrary value, causing callers to consume a bogus pseudo-errno instead of treating the lookup result as corrupted on-disk metadata. Fix this at the source by normalizing every error-marked MFT reference returned from ntfs_lookup_inode_by_name() to ERR_MREF(-EIO). Apply this to all four directory lookup return paths so every caller gets a validated result without needing additional checks or an API change. This keeps the sanitization in the common lookup helper, which is cleaner than duplicating validation in each caller.
Severity
9.1 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 1e9ea7e04472d4e5e12e58c881eaacfb3e49b669 , < 83f396d881c4fd312c7fd5fff2c157fc21104464 (git)
Affected: 1e9ea7e04472d4e5e12e58c881eaacfb3e49b669 , < d97a36bae86a9a4021562ded2987f904e6bcb1d7 (git)
guessed Create a notification for this product.
Linux Linux Affected: 7.1
Unaffected: 0 , < 7.1 (semver)
Unaffected: 7.1.5 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/ntfs/dir.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "83f396d881c4fd312c7fd5fff2c157fc21104464",
              "status": "affected",
              "version": "1e9ea7e04472d4e5e12e58c881eaacfb3e49b669",
              "versionType": "git"
            },
            {
              "lessThan": "d97a36bae86a9a4021562ded2987f904e6bcb1d7",
              "status": "affected",
              "version": "1e9ea7e04472d4e5e12e58c881eaacfb3e49b669",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/ntfs/dir.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "7.1"
            },
            {
              "lessThan": "7.1",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "7.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "7.1",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nntfs: sanitize MFT references returned from ntfs_lookup_inode_by_name()\n\nntfs_lookup_inode_by_name() returns MFT references read from directory\nindex entries on disk. These values are untrusted, but the function can\ncurrently return an error-marked MFT reference to its callers without\nvalidating it.\n\nCallers later decode lookup failures with MREF_ERR(). A crafted NTFS image\ncan set the MREF error bit while leaving the low bits as an arbitrary\nvalue, causing callers to consume a bogus pseudo-errno instead of treating\nthe lookup result as corrupted on-disk metadata.\n\nFix this at the source by normalizing every error-marked MFT reference\nreturned from ntfs_lookup_inode_by_name() to ERR_MREF(-EIO). Apply this to\nall four directory lookup return paths so every caller gets a validated\nresult without needing additional checks or an API change.\n\nThis keeps the sanitization in the common lookup helper, which is cleaner\nthan duplicating validation in each caller."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - fs/ntfs registers ntfs_export_ops; remote nfsd/ksmbd LOOKUP/OPEN/stat on an exported crafted NTFS volume reaches ntfs_lookup\u2192ntfs_lookup_inode_by_name parsing attacker-controlled INDX indexed_file values without local shell access.\nAC:L - The attacker fully controls on-disk directory index indexed_file MFT references and can set the ERR_MREF error bit with arbitrary low bits; decoding the forged pseudo-errno via MREF_ERR() is deterministic from a crafted image with no race or external timing.\nPR:N - Triggering needs only a malicious NTFS image (USB, loop, dual-boot disk) mounted by the host or lookup access to exported NTFS paths via NFS/SMB; no init-namespace root or CAP_SYS_ADMIN is required on the code path that consumes the bogus errno.\nUI:N - fill_super mount-time lookups (hiberfil.sys, $Quota) and subsequent local or remote path lookups call ntfs_lookup_inode_by_name as soon as the crafted volume is mounted or exported, without further per-attack cooperation beyond volume presentation.\nS:U - Forged errno handling perturbs VFS lookup and mount safety decisions within the host kernel/filesystem authority only; this is standard filesystem parsing abuse, not a VM escape, IOMMU bypass, or cross-security-boundary scope change.\nC:N - The flaw only mis-decodes error-marked MFT references into attacker-chosen errno values returned to callers; there is no out-of-bounds read, use-after-free, or other kernel memory disclosure primitive.\nI:H - Spoofing -ENOENT via error-bit indexed_file can add negative dentries for present index entries and make check_windows_hibernation_status/load_and_init_quota treat hiberfil.sys/$Quota as absent, bypassing hibernation/quota guards and permitting rw corruption of live Windows hibernation and NTFS metadata.\nA:H - Hibernation-check bypass allows rw I/O on a suspended Windows volume, corrupting hiberfil.sys and preventing resume; forged lookup errnos also leave persistent negative-cache and index inconsistencies that can render the volume or dependent OS unusable."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:41:17.414Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/83f396d881c4fd312c7fd5fff2c157fc21104464"
        },
        {
          "url": "https://git.kernel.org/stable/c/d97a36bae86a9a4021562ded2987f904e6bcb1d7"
        }
      ],
      "title": "ntfs: sanitize MFT references returned from ntfs_lookup_inode_by_name()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-72188",
    "datePublished": "2026-08-15T05:53:49.593Z",
    "dateReserved": "2026-08-09T03:40:39.911Z",
    "dateUpdated": "2026-08-17T05:41:17.414Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-72188",
      "date": "2026-08-21",
      "epss": "0.00467",
      "percentile": "0.3877"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-72188\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-08-15T06:21:37.197\",\"lastModified\":\"2026-08-17T06:18:19.383\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nntfs: sanitize MFT references returned from ntfs_lookup_inode_by_name()\\n\\nntfs_lookup_inode_by_name() returns MFT references read from directory\\nindex entries on disk. These values are untrusted, but the function can\\ncurrently return an error-marked MFT reference to its callers without\\nvalidating it.\\n\\nCallers later decode lookup failures with MREF_ERR(). A crafted NTFS image\\ncan set the MREF error bit while leaving the low bits as an arbitrary\\nvalue, causing callers to consume a bogus pseudo-errno instead of treating\\nthe lookup result as corrupted on-disk metadata.\\n\\nFix this at the source by normalizing every error-marked MFT reference\\nreturned from ntfs_lookup_inode_by_name() to ERR_MREF(-EIO). Apply this to\\nall four directory lookup return paths so every caller gets a validated\\nresult without needing additional checks or an API change.\\n\\nThis keeps the sanitization in the common lookup helper, which is cleaner\\nthan duplicating validation in each caller.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"fs/ntfs/dir.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"1e9ea7e04472d4e5e12e58c881eaacfb3e49b669\",\"lessThan\":\"83f396d881c4fd312c7fd5fff2c157fc21104464\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"1e9ea7e04472d4e5e12e58c881eaacfb3e49b669\",\"lessThan\":\"d97a36bae86a9a4021562ded2987f904e6bcb1d7\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"fs/ntfs/dir.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"7.1\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"7.1\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.5\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H\",\"baseScore\":9.1,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.2}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/83f396d881c4fd312c7fd5fff2c157fc21104464\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/d97a36bae86a9a4021562ded2987f904e6bcb1d7\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-18T08:38:50+00:00",
      "cve": "CVE-2026-72188",
      "id": "CVE-2026-72188",
      "initial_release_date": "2026-08-15T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: ntfs: sanitize MFT references returned from ntfs_lookup_inode_by_name()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-72188.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-21T00:42:48Z",
      "cve": "CVE-2026-72188",
      "id": "CVE-2026-72188",
      "initial_release_date": "2026-08-21T00:42:48Z",
      "product_status:known_affected": "255",
      "product_status:known_not_affected": "29",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-72188",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-72188.json",
      "version": "2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.