CVE-2026-72185

A flaw was found in the Linux kernel's NTFS filesystem driver. A specially crafted NTFS image could cause the system to incorrectly process attribute data during mounting. This could lead to a kernel warning and corruption of internal data structures, potentially resulting in system instability or a denial of service (DoS) by preventing the image from being mounted.

A moderate impact flaw was found in the Linux kernel's NTFS filesystem driver. When a specially crafted NTFS image is mounted, ntfs_map_runlist_nolock() can look up an attribute extent for a target VCN and receive a resident attribute record where a non-resident attribute is expected. Because this mismatch was previously only caught by a WARN_ON(), which does not stop execution, the code falls through and reads a->data.non_resident.highest_vcn from what is actually a resident attribute, accessing the wrong union member and corrupting the internal VCN range check. This can lead to a kernel warning and system instability, resulting in a local denial of service. Exploitation requires local access with privileges sufficient to mount a filesystem image, which is reflected in the Red Hat CVSS:3.1 score of 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). All Red Hat Enterprise Linux (kernel, kernel-rt) and Red Hat In-Vehicle OS (kernel, kernel-ivos-qualcomm) streams in scope are marked NOT AFFECTED because the vulnerable code is not present in the shipped kernels. The CVE.org severity of 9.8 (CVSS:3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) is significantly higher than the Red Hat score because it assumes a network-reachable, unauthenticated attack; the actual attack vector requires local access and the ability to mount a crafted NTFS image, so Red Hat rates this flaw as moderate.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.