CVE-2026-72206

A flaw was found in the Linux kernel's NTFS filesystem driver. Insufficient validation of index block headers within INDX blocks could allow a local attacker to craft a malicious NTFS filesystem image. When this image is processed by the kernel, it could lead to a kernel panic due to an out-of-bounds read, resulting in a denial of service (DoS).

This vulnerability is rated as having a Moderate impact because exploitation requires local access to mount a specially crafted filesystem, and the blast radius is confined to a kernel panic causing a denial of service without compromising confidentiality or integrity. On default Red Hat Enterprise Linux installations, the legacy NTFS kernel module is not enabled or supported, preventing automatic exposure. Supported Red Hat Enterprise Linux releases do not include the vulnerable code, so typical deployments remain unaffected.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.