CVE-2026-72205

The CVE-2026-72205 entry concerns a Linux kernel ntfs mount failure leak: on fill_super error paths, vol-owned allocations (nls_map, volume_label) and lcn_empty_bits_per_page were not freed, leading to per‑mount leaks until module unload. The issue affects ntfs_fill_super() and err_out_now paths,...

CVE-2026-72205 ntfs: free volume-wide resources on fill_super failure

In the Linux kernel, the following vulnerability has been resolved: ntfs: free volume-wide resources on fillsuper failure ntfsfillsuper's erroutnow path frees only the volume struct via kfreevol, leaving several vol-owned allocations behind on every mount failure: - vol-nlsmap, loaded by...

CVE-2026-72205

In the Linux kernel, the following vulnerability has been resolved: ntfs: free volume-wide resources on fillsuper failure ntfsfillsuper's erroutnow path frees only the volume struct via kfreevol, leaving several vol-owned allocations behind on every mount failure: - vol-nlsmap, loaded by...

EUVD-2026-58954

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: bound copylcns dp-pagelcns index in analysis pass In logreplay's analysis pass, after finddp returns a valid DIRPAGEENTRY for the targetattr, targetvcn tuple, the copylcns block walks lrh-lcnsfollow further entries: t16...

CVE-2026-72196 fs/ntfs3: bound copy_lcns dp->page_lcns[] index in analysis pass

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: bound copylcns dp-pagelcns index in analysis pass In logreplay's analysis pass, after finddp returns a valid DIRPAGEENTRY for the targetattr, targetvcn tuple, the copylcns block walks lrh-lcnsfollow further entries: t16...

CVE-2026-72196

CVE-2026-72196 involves the Linux kernel ntfs3 code where log_replay analysis could write past the dp->page_lcns[] array. The root cause: after find_dp() validates only the first cluster, the code loops over lrh->lcns_follow and writes dp->page_lcns[j + i] without bounding i by dp->lc...

CVE-2026-72196 fs/ntfs3: bound copy_lcns dp->page_lcns[] index in analysis pass

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: bound copylcns dp-pagelcns index in analysis pass In logreplay's analysis pass, after finddp returns a valid DIRPAGEENTRY for the targetattr, targetvcn tuple, the copylcns block walks lrh-lcnsfollow further entries: t16...

CVE-2026-72195 fs/ntfs3: bound attr_off in UpdateResidentValue against data_off

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: bound attroff in UpdateResidentValue against dataoff In doaction's UpdateResidentValue case fslog.c:3307, lrh-attroff and lrh-redolen come from the on-disk LRH. When they satisfy aoff + dlen res.dataoff, the assignment...

EUVD-2026-58951

In the Linux kernel, the following vulnerability has been resolved: ntfs3: cap RESTARTTABLE free-chain walker at rt-used A crafted NTFS3 disk image triggers an in-kernel infinite loop at mount time, hanging the mounting thread and firing the soft-lockup watchdog within 22s on multi-CPU hosts pani...

CVE-2026-72193 ntfs3: cap RESTART_TABLE free-chain walker at rt->used

In the Linux kernel, the following vulnerability has been resolved: ntfs3: cap RESTARTTABLE free-chain walker at rt-used A crafted NTFS3 disk image triggers an in-kernel infinite loop at mount time, hanging the mounting thread and firing the soft-lockup watchdog within 22s on multi-CPU hosts pani...

CVE-2026-72193

CVE-2026-72193 concerns the in-tree ntfs3 kernel driver. A crafted NTFS3 disk image could trigger an in-kernel infinite loop during mount via a corrupted RESTART_TABLE free-chain, hanging the mounting thread and potentially invoking the soft-lockup watchdog on multi-CPU systems. The vulnerability...

CVE-2026-72193 ntfs3: cap RESTART_TABLE free-chain walker at rt->used

In the Linux kernel, the following vulnerability has been resolved: ntfs3: cap RESTARTTABLE free-chain walker at rt-used A crafted NTFS3 disk image triggers an in-kernel infinite loop at mount time, hanging the mounting thread and firing the soft-lockup watchdog within 22s on multi-CPU hosts pani...

CVE-2026-72185 ntfs: fix WARN_ON for resident attribute in ntfs_map_runlist_nolock()

In the Linux kernel, the following vulnerability has been resolved: ntfs: fix WARNON for resident attribute in ntfsmaprunlistnolock When ntfsmaprunlistnolock needs to look up the attribute extent containing a target VCN ctxneedsreset == true, it calls ntfsattrlookup and then expects the result to...

CVE-2026-72185 ntfs: fix WARN_ON for resident attribute in ntfs_map_runlist_nolock()

In the Linux kernel, the following vulnerability has been resolved: ntfs: fix WARNON for resident attribute in ntfsmaprunlistnolock When ntfsmaprunlistnolock needs to look up the attribute extent containing a target VCN ctxneedsreset == true, it calls ntfsattrlookup and then expects the result to...

EUVD-2026-58943

In the Linux kernel, the following vulnerability has been resolved: ntfs: fix WARNON for resident attribute in ntfsmaprunlistnolock When ntfsmaprunlistnolock needs to look up the attribute extent containing a target VCN ctxneedsreset == true, it calls ntfsattrlookup and then expects the result to...

CVE-2026-72185

The CVE-2026-72185 entries describe a Linux kernel NTFS vulnerability in ntfs_map_runlist_nolock() where a crafted NTFS image could place a resident attribute where a non-resident attribute is expected. The underlying bug was a mismatch between expected attribute type and actual data, previously ...

CVE-2026-72034 fhandle: reject detached mounts in capable_wrt_mount()

In the Linux kernel, the following vulnerability has been resolved: fhandle: reject detached mounts in capablewrtmount The recent fhandle RCU fix moved the mount namespace capability check into capablewrtmount, so a non-NULL mntnamespace survives the nscapable dereference. The helper still assume...

CVE-2026-72034 fhandle: reject detached mounts in capable_wrt_mount()

In the Linux kernel, the following vulnerability has been resolved: fhandle: reject detached mounts in capablewrtmount The recent fhandle RCU fix moved the mount namespace capability check into capablewrtmount, so a non-NULL mntnamespace survives the nscapable dereference. The helper still assume...

EUVD-2026-58992

In the Linux kernel, the following vulnerability has been resolved: fhandle: reject detached mounts in capablewrtmount The recent fhandle RCU fix moved the mount namespace capability check into capablewrtmount, so a non-NULL mntnamespace survives the nscapable dereference. The helper still assume...

CVE-2026-68459 f2fs: fix potential deadlock in gc_merge path of f2fs_balance_fs()

In the Linux kernel, the following vulnerability has been resolved: f2fs: fix potential deadlock in gcmerge path of f2fsbalancefs When we mount device w/ gcmerge mount option, we may suffer below potential deadlock: Kworker GC trehad Truncator - f2fswritecachepages - f2fswritesingledatapage -...