CVE-2026-72203

CVE-2026-72203 concerns the Linux kernel NTFS driver and describes a deadlock (ABBA) between extent_lock and extent mrec_lock triggered by writes to normal extents and the $MFT folio. The fix removes all extent_lock and extent mrec_lock acquisitions from the MFT folio writeback path, eliminating ...

CVE-2026-72202

Technical details are not publicly available in the provided documents. Monitor for updates from vendors and security trackers for affected products, patches, and remediation status.

CVE-2026-72201

CVE-2026-72201 affects the Linux kernel NTFS implementation where index entries are validated after reading an index root or block. Root cause: insufficient immediate validation of index entries during lookup/readdir paths, leading to potential missed checks. The CVSS appears CRITICAL (Network, N...

CVE-2026-72200

CVE-2026-72200 affects Linux kernel NTFS support: the mapping-pairs parser can overflow when accumulating relative LCN deltas in a signed integer, potentially turning a corrupted runlist into a different set of physical clusters. Root cause: signed overflow when a runlist shape reaches S64_MAX an...

CVE-2026-72199

The CVE refers to the Linux kernel ntfs patch that validates resident index root values on lookup. The fix ensures 8-byte alignment of index header fields, sane entries_offset, index_length within allocated_size, and allocated_size consistency within the resident value, and it validates header in...

CVE-2026-72197

The CVE-2026-72197 issue affects the Linux kernel, specifically the fs/ntfs3 path for DeleteIndexEntryAllocation. The root cause is that e->size can cause an overlong memmove when e + e->size points past hdr + hdr->used, leading to a dangerous memmove length. A corresponding guard alread...

CVE-2026-72198

CVE-2026-72198 relates to the Linux kernel NTFS handling of resident/non-resident attribute data. The fix rejects non-resident records for all resident-only attribute types in the shared validator, extending the prior FILE_NAME and VOLUME_NAME handling to include STANDARD_INFORMATION, OBJECT_ID, ...

CVE-2026-72196

CVE-2026-72196 involves the Linux kernel ntfs3 code where log_replay analysis could write past the dp->page_lcns[] array. The root cause: after find_dp() validates only the first cluster, the code loops over lrh->lcns_follow and writes dp->page_lcns[j + i] without bounding i by dp->lc...

CVE-2026-72195

CVE-2026-72195 concerns Linux kernel ntfs3: UpdateResidentValue may underflow data_size when attr_off/redo_len derive from on-disk LRH and aoff + dlen

CVE-2026-72194

The CVE-2026-72194 issue affects the Linux kernel’s ntfs3 implementation. A depth-unlimited recursion in indx_find_buffer() when traversing the NTFS B+ tree can be triggered by mounting a malicious NTFS image and deleting a file whose index entry engages the rebalancing path, potentially causing ...

CVE-2026-72193

CVE-2026-72193 concerns the in-tree ntfs3 kernel driver. A crafted NTFS3 disk image could trigger an in-kernel infinite loop during mount via a corrupted RESTART_TABLE free-chain, hanging the mounting thread and potentially invoking the soft-lockup watchdog on multi-CPU systems. The vulnerability...

CVE-2026-72192

The CVE-2026-72192 issue affects the Linux kernel ntfs3 code. Specifically, indx_insert_into_root before hdr_insert_head can overrun a kmalloc(index_block_size) when shrinking root->index_block_size (e.g., to 512) after the root is populated. A crafted NTFS image triggers a memcpy of attacker-...

CVE-2026-72190

CVE-2026-72190 : The Linux kernel NTFS handling has a deadlock in rename due to mismatched lock ordering on mrec_lock between inodes and their parent directories. The functions ntfs_file_fsync(), ntfs_dir_fsync(), and __ntfs_write_inode() acquire an inode’s mrec_lock before its parent directory’s...

CVE-2026-72191

CVE-2026-72191 (Linux kernel ntfs3): The issue arises in indx_insert_into_buffer where sp and sp_size from hdr_find_split() can cause an underflow when sp_size exceeds remaining buffer, producing an out-of-bounds write and kernel panic. Reports show a crafted NTFS image where interior NTFS_DE siz...

CVE-2026-72189

CVE-2026-72189 concerns the Linux kernel ntfs attribute-list update path. When the superblock becomes inactive, generic_shutdown_super() clears SB_ACTIVE and eviction of inodes can cause the fake inode for a base inode’s unnamed $ATTRIBUTE_LIST to be referenced in a way that leads to a self-deadl...

CVE-2026-72188

The CVE-2026-72188 issue affects the Linux kernel NTFS handling: ntfs_lookup_inode_by_name() can return error-marked MFT references without validation, causing callers to misinterpret a MREF_ERR() with arbitrary low bits as a valid result. The vulnerability stems from untrusted on-disk MFT refere...

CVE-2026-72186

CVE-2026-72186 affects the Linux kernel NTFS handling: system files such as $Bitmap exposed via show_sys_files can be written from userspace, causing volume corruption and a deadlock between writeback and the folio due to the cluster allocator scanning the inode’s page cache. The fixed approach m...

CVE-2026-72187

The CVE covers a Linux kernel ntfs-related self-deadlock during inode eviction. A) Root cause: an attribute-list update while allocating clusters can drop the last reference to a temporary attribute inode, causing eviction of that inode to drop its reference to the base inode; if the base inode i...

CVE-2026-72185

The CVE-2026-72185 entries describe a Linux kernel NTFS vulnerability in ntfs_map_runlist_nolock() where a crafted NTFS image could place a resident attribute where a non-resident attribute is expected. The underlying bug was a mismatch between expected attribute type and actual data, previously ...

CVE-2026-72184

The CVE-2026-72184 issue in the Linux kernel NTFS code leaks memory: ntfs_non_resident_attr_insert_range() allocates hole_rl, and on failure of ntfs_attr_map_whole_runlist() the error path drops ni->runlist.lock and returns without freeing hole_rl, leaking sizeof(*hole_rl) * 2 bytes. The fix f...