CVE-2026-72197

A flaw was found in the Linux kernel's NTFS3 file system driver. A local attacker can exploit this vulnerability by mounting a specially crafted NTFS image. This manipulation causes an incorrect calculation of memory movement length, leading to an out-of-bounds write operation. The primary consequence is a kernel crash, resulting in a denial of service (DoS) for the system.

Red Hat has evaluated this vulnerability as having Moderate impact because exploitation requires local access or the capability to mount a crafted storage device, with the primary outcome being a denial of service via kernel crash. The ntfs3 file system driver is not enabled in default Red Hat Enterprise Linux kernel configurations, significantly limiting exposure in standard environments. Deployments are not affected unless custom kernels or non-standard configurations enabling this driver are utilized.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.