CVE-2026-72188

A flaw was found in the Linux kernel's NTFS filesystem driver. A remote attacker could craft a malicious NTFS image that, when processed, causes the ntfs_lookup_inode_by_name() function to return an unvalidated error-marked MFT (Master File Table) reference. This can lead to callers consuming a bogus error code, misinterpreting corrupted on-disk metadata, and potentially causing system instability or a denial of service.

A moderate-impact vulnerability was found in the Linux kernel's NTFS filesystem driver (fs/ntfs/dir.c). The ntfs_lookup_inode_by_name() function returns MFT (Master File Table) references that are read from on-disk directory index entries without validating them. A local attacker able to cause the kernel to process a specially crafted NTFS filesystem image could set the MREF error bit while leaving the low bits as an arbitrary value, causing callers that decode lookup failures with MREF_ERR() to consume a bogus pseudo-errno instead of treating the lookup result as corrupted on-disk metadata. This can lead to system instability or a denial of service; there is no impact on confidentiality or integrity. All Red Hat Enterprise Linux (including kernel-rt) and Red Hat In-Vehicle OS kernel streams have been assessed as NOT affected because the vulnerable code is not present in the shipped kernel versions. The CVE.org record rates this flaw as CRITICAL with a network attack vector (CVSS 3.1 score 9.1), while Red Hat rates it MODERATE (CVSS 3.1 score 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) because exploitation requires local access to process a crafted NTFS image, and the impact is limited to availability.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.