CVE-2026-72198

A flaw was found in the Linux kernel's NTFS file system driver. This vulnerability arises from the incorrect handling of non-resident records for attributes that are expected to be resident. This can lead to 'union confusion paths' where the kernel attempts to read data from an incorrect memory location or misinterprets attribute values. While the direct impact is not explicitly detailed, such issues can typically lead to system instability or a denial of service.

A flaw was found in the Linux kernel's NTFS file system driver. The shared lookup-time attribute validator did not reject non-resident records for attribute types whose formats require resident values (such as $STANDARD_INFORMATION, $VOLUME_INFORMATION, and $INDEX_ROOT), so code paths like inode load, standard-information updates, volume-flag writes, and directory index handling read resident union fields from records that were actually non-resident. A local user able to mount a specially crafted NTFS filesystem could exploit this resident/non-resident union confusion to cause a system crash or denial of service (Red Hat CVSS 5.5, CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, moderate). The CVEORG severity of 7.8 (important) differs from the Red Hat assessment because Red Hat evaluates the impact as limited to availability, with no demonstrated path to confidentiality or integrity impact, and exploitation requires local access with sufficient privilege to mount a filesystem. All currently listed Red Hat Enterprise Linux and Red Hat In-Vehicle OS kernel streams are marked not affected for this flaw because the vulnerable code is not present in the shipped kernels.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.