CVE-2026-72196

A flaw was found in the Linux kernel's NTFS3 file system driver. A local attacker could craft a malicious NTFS file system image that, when mounted, would cause a malformed log record header (LRH) to trigger an out-of-bounds write during log replay. This memory corruption could lead to a system crash, resulting in a denial of service.

This vulnerability is rated as Moderate impact because triggering it requires local access to mount a specially crafted filesystem image, limiting the primary impact to a kernel crash and denial of service. Supported Red Hat Enterprise Linux releases are not affected as the NTFS3 filesystem driver is not enabled in standard kernels. In environments running custom kernels with this driver enabled, exploitation requires administrative privileges to mount media or physical device access.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.