CVE-2026-72208

A flaw was found in the Linux kernel's NTFS file system driver. A missing bounds check when processing Extended Attribute (EA) entries in the ntfs_ea_lookup and ntfs_listxattr functions could allow a local attacker to craft a malicious NTFS file system. When this file system is mounted, it could lead to an out-of-bounds read, potentially causing a system crash (Denial of Service) or information disclosure.

Red Hat Product Security rates this vulnerability as Moderate because exploitation requires mounting a maliciously crafted storage image, a task that ordinarily demands local root privileges or physical access to insert external media. The impact is constrained to a local denial of service via system crash or out-of-bounds memory leakage, without enabling arbitrary code execution. Furthermore, default enterprise configurations do not automatically mount untrusted file systems, substantially limiting practical exposure.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.