Security readout for executives and security teams
Plain-English summary
A Linux NTFS driver flaw can incorrectly convert an empty file’s data record into a format that filesystem checks consider corrupt. Systems are exposed only when vulnerable kernel code processes and modifies NTFS volumes. Although the supplied CVSS rating is 9.8, the sources do not establish remote reachability, demonstrated compromise, or active exploitation.
Executive priority
Prioritize confirmation and patching on systems that actively write NTFS volumes, especially those processing untrusted media or images. Treat the published critical score seriously, but do not assume remote compromise from the score alone. Expedite backups and integrity review where corruption indicators appear.
Technical view
During ntfs_resident_attr_resize(), the driver may free MFT record space by converting resident attributes to non-resident form. Zero-length $DATA attributes must not be selected because fsck treats that representation as corruption. The referenced stable-kernel commits implement the correction. The supplied affected-version data is ambiguous and should be verified against distributor guidance.
Likely exposure
Potential exposure is limited to Linux systems running affected NTFS code and modifying NTFS filesystems under conditions triggering resident-attribute growth. The bundle lists versions 7.1, 0, 7.1.5, and 7.2, but does not clearly express ranges. Internet exposure alone does not prove exploitability.
Exploitation context
CISA KEV status is false, and the supplied sources provide no evidence of active exploitation or a public exploit. Despite a network-reachable CVSS vector, the technical description concerns NTFS filesystem processing and does not explain how an unauthenticated remote attacker could reach the vulnerable path.
Researcher notes
The confirmed consequence is creation of an NTFS attribute representation considered corrupt by fsck. The bundle does not demonstrate memory corruption, code execution, confidentiality loss, or a remote trigger, despite the CVSS 9.8 C/I/A assessment. Analyze distributor backports and exact vulnerable ranges before asserting exposure.
Mitigation direction
- Obtain a kernel update incorporating the referenced stable-kernel fixes from the system vendor.
- Confirm affected-version ranges with the Linux distribution because the supplied version data is ambiguous.
- Restrict untrusted NTFS media and attacker-controlled NTFS write workflows until affected systems are updated.
- Back up important NTFS-hosted data before repair or filesystem maintenance.
Validation and detection
- Inventory kernel builds on systems that mount or modify NTFS filesystems.
- Compare each kernel build with distributor advisories and the two referenced fix commits.
- Identify services or workflows that accept untrusted NTFS images, devices, or filesystem content.
- Review filesystem-check and kernel logs for NTFS corruption involving zero-length non-resident data attributes.
- Verify the installed update includes equivalent handling that excludes zero-length $DATA attributes.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2026-72207 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H3.95.9LinuxVulnerability scoring details
Base CVSS 3.1 score
9.8CriticalVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/ceb49c37250125d418410988f2376ed4d57a6706CVE reference, Linux
- https://git.kernel.org/stable/c/0aad21570197973af4a1b25b3fb8ed3aeb9e7670CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.