Executive brief
The Linux kernel's NTFS filesystem driver had insufficient validation of index entries when reading directory structures from disk. An attacker with access to a malicious NTFS-formatted volume could trigger kernel memory corruption or denial of service by crafting invalid directory index entries that bypass validation checks.
Technical details
This vulnerability is a missing input validation issue in the NTFS filesystem driver (fs/ntfs/index.c and fs/ntfs/dir.c). The vulnerability existed because index entry validation checks were performed during lookup and readdir operations rather than immediately after reading the index structures from disk. This allowed malformed index entries to reach code paths that assumed validity, potentially leading to out-of-bounds memory access or buffer overflow. The fix consolidates validation to occur immediately after reading index root or index blocks, eliminating repeated validation in lookup/readdir paths and reducing the attack surface. The vulnerability affects all Linux kernel versions prior to the patch commit (dated 2026-05-23), with backports to stable series v7.1+. Local or direct access to a malicious NTFS filesystem is required to exploit this issue.
Affected products
- Linux Linux kernel Prior to patch commit 2221b691d7b2e17f08153f95848dacaa5d87e21d; affects v7.1 and later stable series
Timeline
- 2026-08-15: disclosed: CVE-2026-72201 published on NVD
- 2026-05-23: patched: Fix committed to linux kernel (commit 2221b691d7b2e17f08153f95848dacaa5d87e21d)
- 2026-07-24: patched: Backport merged to stable series (commit e2b95d3adb558ddd5685f9e072ec8661d57ee3a9)