Executive brief
The Linux kernel's NTFS3 filesystem driver contains a stack overflow vulnerability in its B+ tree index parsing code. An attacker can craft a malicious NTFS filesystem image with circular index node references that causes unbounded recursion, crashing the system. This can be triggered by simply mounting a malicious NTFS image (e.g., from a USB drive) and deleting a file, making it exploitable via basic user operations on a desktop system.
Technical details
The vulnerability is a stack overflow caused by unbounded recursion in the indx_find_buffer() function within fs/ntfs3/index.c. The function recursively descends a B+ tree index structure with no depth limit, allowing a crafted NTFS image with circular node references to cause infinite recursion. The attack is triggered during file deletion when indx_delete_entry() calls indx_find_buffer() on a malicious index structure. The fix adds a depth parameter and returns -EINVAL when recursion depth exceeds the fnd->nodes array bound (20 levels), matching the constraint already enforced by indx_find(). The vulnerability affects the kernel's NTFS filesystem support since its initial implementation.
Affected products
- Linux Linux kernel All versions with NTFS3 filesystem support (from commit 82cae269cfa9 onwards)
Timeline
- 2026-08-15: disclosed: CVE-2026-72194 published
- 2026-04-30: patched: Fix committed upstream (commit 1ebd684b8f627f75bc3e03f8b2ad8400fd1f02cd)
- 2026-07-24: patched: Fix backported to stable kernels (commit 65357a81f64cb3fbe13b4b937586755e4b3a072f)