CVE-2026-72202

A flaw was found in the Linux kernel's NTFS filesystem driver. When calculating free clusters or Master File Table (MFT) records, a temporary state object is allocated on the heap. If this allocation fails, processes waiting for these counts can become unresponsive, leading to a denial of service (DoS) for the system.

This vulnerability is rated as Moderate severity for Red Hat Enterprise Linux because exploitation is confined to local users who can mount or interact with an NTFS volume and requires rare heap allocation failures, resulting only in a system hang rather than privilege escalation or data exposure. In typical enterprise deployments, NTFS storage is rarely utilized and the legacy NTFS driver is not loaded by default. Furthermore, supported Red Hat Enterprise Linux kernel releases do not incorporate the upstream code changes that introduced this issue.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.