CVE-2026-72192

A flaw was found in the Linux kernel's ntfs3 module. A local unprivileged attacker can exploit this vulnerability by mounting a specially crafted NTFS image and performing a file creation operation. This can lead to a controlled out-of-bounds write, a type of memory corruption. This memory corruption could potentially allow for further exploitation, such as arbitrary code execution or privilege escalation.

This vulnerability is classified as Moderate impact because triggering the condition requires local privileges to mount a malformed storage volume, constraining the attack surface. Supported Red Hat Enterprise Linux releases are not affected by default, as the ntfs3 driver is not enabled in standard kernels. Where the module is actively enabled and utilized, an attacker mounting a compromised file system could cause adjacent memory corruption or system instability.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.