LiveActive security incident?Get immediate response
CVE Record

CVE-2026-72199: ntfs: validate resident index root values on lookup

In the Linux kernel, the following vulnerability has been resolved: ntfs: validate resident index root values on lookup Resident $INDEX_ROOT values carry index header fields that callers consume after lookup. Some callers already validate parts of the layout before walking entries, but those checks are scattered and do not cover all root header invariants, such as entries_offset alignment and lower bound, index_length, and allocated_size consistency. The resident root resize paths now keep these header fields consistent while the value size changes: ntfs_ir_truncate() lowers index.allocated_size before shrinking the resident value, and ntfs_ir_reparent() grows the resident value before publishing a larger root header. Lookup-time validation can therefore cover these invariants without tripping over the driver's own resize paths. Add $INDEX_ROOT to the minimum resident value size table and validate the resident index header fields before returning the attribute from lookup. Require 8-byte aligned index header fields, a sane entries_offset, an index_length within allocated_size, allocated_size within the resident value, and enough entry space for at least an index entry header. The shared validator already rejects non-resident records for resident-only attribute types, including $INDEX_ROOT.

CriticalCVSS 9.8Not KEV-listedUpdated
Glexia's TakeAutomated analysiscritical

Security readout for executives and security teams

Plain-English summary

Linux's NTFS driver could trust invalid filesystem index metadata during lookup. If an affected system processes such NTFS data, unchecked values may reach kernel code. The supplied record rates this critical at 9.8, but does not explain the resulting failure mode or report real-world attacks.

Executive priority

Prioritize rapid vendor assessment and patching for systems that process NTFS content, especially shared-ingestion and removable-media workflows. The critical score warrants urgency, but available evidence does not support declaring an active-exploitation emergency or assuming the flaw is directly Internet reachable.

Technical view

The NTFS driver returned resident $INDEX_ROOT attributes without centrally validating header invariants. Misaligned or inconsistent entries_offset, index_length, and allocated_size values could reach callers. The fix preserves header consistency during resizing and validates alignment, bounds, allocation consistency, and minimum entry space at lookup.

Likely exposure

The clearest exposure is Linux systems using affected kernels to mount, inspect, or otherwise process NTFS filesystems. The bundle indicates affected releases around Linux 7.1–7.2, but its version formatting is ambiguous. Confirm exact distribution package exposure through vendor advisories and backport records.

Exploitation context

The supplied KEV status is false, and no source reports exploitation in the wild or a public exploit. Invalid resident index-root metadata is the apparent trigger class, but the delivery path, reliability, and resulting security primitive are not documented. Active exploitation is therefore unconfirmed.

Researcher notes

The supplied CVSS vector states network attackability, while the technical narrative establishes only NTFS metadata parsing during lookup. Do not assume direct remote reachability without further vendor evidence. Exact affected-version boundaries and the consequence of failed validation are also unclear from the bundle.

Mitigation direction

  • Obtain Linux distribution guidance and install kernel packages containing the applicable cited stable fix.
  • Reboot into the updated kernel and remove vulnerable kernels from normal boot paths.
  • Until patched, restrict processing of untrusted NTFS media where operationally feasible.
  • Verify distributor backports rather than inferring fixed status from upstream version numbers alone.

Validation and detection

  • Inventory running kernel versions and identify hosts that mount, scan, or ingest NTFS filesystems.
  • Map each vendor kernel build to the cited fix commits or distributor advisory.
  • After updating, confirm every system is running the patched kernel build.
  • Use vendor regression testing to confirm invalid index roots are rejected safely.
  • Review kernel logs for NTFS faults, recognizing that silence does not prove non-exposure.
Prepared
Confidence
medium
Sources
4

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2026-72199 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Critical
CVSS
9.8 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
3Timeline events
0ADP providers
3Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
9.8CVSS 3.1CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H3.95.9Linux

Vulnerability scoring details

Base CVSS 3.1 score

9.8Critical
CVSS 3.1 vector shape for CVE-2026-72199Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux0a8ac0c1fa0b99a5b29002bc7f232ed7eafddef0, 0a8ac0c1fa0b99a5b29002bc7f232ed7eafddef0unaffected
LinuxLinux7.1, 0, 7.1.5, 7.2affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.