CVE-2026-72199

A flaw was found in the NTFS filesystem driver of the Linux kernel. This vulnerability arises from insufficient validation of resident index root values during lookup operations. An attacker could potentially craft a malicious NTFS filesystem that, when processed by the kernel, leads to inconsistent internal data structures. This could result in system instability or a denial of service (DoS) condition.

This moderate impact flaw is in the NTFS filesystem driver of the Linux kernel. Resident $INDEX_ROOT values carry index header fields (such as entries_offset, index_length, and allocated_size) that callers consume after lookup, but the existing validation was scattered and did not cover all root header invariants. A local attacker with the ability to process a specially crafted NTFS filesystem could cause the kernel to operate on inconsistent internal data structures, resulting in system instability or a denial of service. Red Hat rates this flaw as moderate (CVSS 3.1: AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) because exploitation requires local access with privileges and the impact is limited to availability; this differs significantly from the upstream CVEORG critical score of 9.8, which assumes a network attack vector without privileges and high confidentiality and integrity impacts that the flaw's technical nature does not support. All Red Hat products currently in scope for this flaw, including the Red Hat Enterprise Linux and Red Hat In-Vehicle OS kernel and kernel-rt components, are not affected because the vulnerable code is not present in the shipped kernels.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.