CVE-2026-72194

A flaw was found in the Linux kernel's NTFS3 filesystem driver. A local attacker could craft a malicious NTFS image with circular index node references. When this filesystem is mounted and a specific file is deleted, it can trigger unbounded recursion in the indx_find_buffer() function, leading to a kernel stack overflow. This vulnerability results in a system panic, causing a Denial of Service (DoS).

This vulnerability is rated as Moderate for Red Hat Enterprise Linux because exploitation is restricted to local vectors requiring a user to mount a maliciously formatted storage device, limiting the potential impact to a denial of service via system crash. Red Hat products are not affected by this flaw as the NTFS3 kernel driver is not included or enabled in supported Red Hat Enterprise Linux releases.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.