CVE-2026-72210

A flaw was found in the Linux kernel's NTFS filesystem driver. An error in how the driver checks the boundaries of data it processes, specifically an 'off-by-one' error, allows it to read one byte beyond its intended memory region. This 'out-of-bounds read' could potentially lead to the disclosure of sensitive information from the kernel's memory.

This flaw is evaluated with a Moderate severity impact because exploitation requires mounting a specially crafted storage volume, restricting attack vectors to local users or physical media attachment. The legacy NTFS kernel module is not enabled by default in standard Red Hat Enterprise Linux releases, significantly reducing practical exposure across typical enterprise configurations. In environments where the module is manually loaded, the out-of-bounds read is limited to a single byte beyond the attribute boundary, primarily presenting a denial-of-service risk or minimal information exposure.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.