CVE-2026-72199: ntfs: validate resident index root values on lookup
In the Linux kernel, the following vulnerability has been resolved:
ntfs: validate resident index root values on lookup
Resident $INDEX_ROOT values carry index header fields that callers
consume after lookup. Some callers already validate parts of the layout
before walking entries, but those checks are scattered and do not cover
all root header invariants, such as entries_offset alignment and lower
bound, index_length, and allocated_size consistency.
The resident root resize paths now keep these header fields consistent
while the value size changes: ntfs_ir_truncate() lowers
index.allocated_size before shrinking the resident value, and
ntfs_ir_reparent() grows the resident value before publishing a larger
root header. Lookup-time validation can therefore cover these invariants
without tripping over the driver's own resize paths.
Add $INDEX_ROOT to the minimum resident value size table and validate the
resident index header fields before returning the attribute from lookup.
Require 8-byte aligned index header fields, a sane entries_offset, an
index_length within allocated_size, allocated_size within the resident
value, and enough entry space for at least an index entry header.
The shared validator already rejects non-resident records for
resident-only attribute types, including $INDEX_ROOT.
Security readout for executives and security teams
Plain-English summary
Linux's NTFS driver could trust invalid filesystem index metadata during lookup. If an affected system processes such NTFS data, unchecked values may reach kernel code. The supplied record rates this critical at 9.8, but does not explain the resulting failure mode or report real-world attacks.
Executive priority
Prioritize rapid vendor assessment and patching for systems that process NTFS content, especially shared-ingestion and removable-media workflows. The critical score warrants urgency, but available evidence does not support declaring an active-exploitation emergency or assuming the flaw is directly Internet reachable.
Technical view
The NTFS driver returned resident $INDEX_ROOT attributes without centrally validating header invariants. Misaligned or inconsistent entries_offset, index_length, and allocated_size values could reach callers. The fix preserves header consistency during resizing and validates alignment, bounds, allocation consistency, and minimum entry space at lookup.
Likely exposure
The clearest exposure is Linux systems using affected kernels to mount, inspect, or otherwise process NTFS filesystems. The bundle indicates affected releases around Linux 7.1–7.2, but its version formatting is ambiguous. Confirm exact distribution package exposure through vendor advisories and backport records.
Exploitation context
The supplied KEV status is false, and no source reports exploitation in the wild or a public exploit. Invalid resident index-root metadata is the apparent trigger class, but the delivery path, reliability, and resulting security primitive are not documented. Active exploitation is therefore unconfirmed.
Researcher notes
The supplied CVSS vector states network attackability, while the technical narrative establishes only NTFS metadata parsing during lookup. Do not assume direct remote reachability without further vendor evidence. Exact affected-version boundaries and the consequence of failed validation are also unclear from the bundle.
Mitigation direction
Obtain Linux distribution guidance and install kernel packages containing the applicable cited stable fix.
Reboot into the updated kernel and remove vulnerable kernels from normal boot paths.
Until patched, restrict processing of untrusted NTFS media where operationally feasible.
Verify distributor backports rather than inferring fixed status from upstream version numbers alone.
Validation and detection
Inventory running kernel versions and identify hosts that mount, scan, or ingest NTFS filesystems.
Map each vendor kernel build to the cited fix commits or distributor advisory.
After updating, confirm every system is running the patched kernel build.
Use vendor regression testing to confirm invalid index roots are rejected safely.
Review kernel logs for NTFS faults, recognizing that silence does not prove non-exposure.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Potential ATT&CK relevance
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
cve · low confidence lookup
CVE-2026-72199 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
1CVSS vectors
3Timeline events
0ADP providers
3Source links
CVSS vector scores
1 official score
We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.