Security readout for executives and security teams
Plain-English summary
Linux could read beyond a valid NTFS extended-attribute entry because it did not first confirm enough data remained. The record assigns CVSS 9.8, indicating potentially severe confidentiality, integrity, and availability impact, but the supplied sources do not describe a demonstrated outcome or attack path.
Executive priority
Treat as an urgent validation and patching issue where Linux systems process NTFS data. Prioritize exposed or untrusted-data workflows, but do not assume remote compromise solely from the CVSS vector because the supplied evidence does not document an end-to-end attack path.
Technical view
The flaw affects ntfs_ea_lookup and ntfs_listxattr. Both could access an EA entry's next_entry_offset field without first verifying that the entry contained enough bytes. The referenced stable-kernel commits add the missing bounds check. The supplied evidence does not establish the resulting memory-safety consequence.
Likely exposure
The record identifies Linux 7.1, 7.1.5, and 7.2 as affected, while other version data is ambiguous. Systems processing NTFS extended attributes through the affected functions warrant validation. The bundle does not explain whether ordinary remote services expose this path.
Exploitation context
No CISA KEV listing is reported, and the supplied sources provide no evidence of active exploitation, public proof-of-concept code, or a confirmed attack chain. Although the CVSS vector states network reachability without privileges or interaction, the sources do not explain how network input reaches the NTFS code.
Researcher notes
The source bundle supplies no CWE, crash details, proof of concept, affected distribution mapping, or explicit consequence beyond the missing bounds check. Version information is unusually narrow and partly ambiguous. Confirm reachability and fixed-package status through kernel or distribution guidance before making fleet-wide exposure claims.
Mitigation direction
- Identify systems running the specifically listed Linux versions.
- Obtain vendor guidance mapping the fix to supported distribution kernels.
- Update to a vendor kernel incorporating the referenced stable fix.
- Restrict unnecessary NTFS processing until affected systems are updated.
Validation and detection
- Record running kernel and distribution package versions across Linux assets.
- Compare vendor advisories against both referenced stable-kernel commits.
- Confirm patched source checks EA-entry bounds before reading next_entry_offset.
- Retest NTFS extended-attribute operations after updating affected systems.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2026-72208 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H3.95.9LinuxVulnerability scoring details
Base CVSS 3.1 score
9.8CriticalVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/d9d9925de1d8f233cc60d3dc356e12f232f97c15CVE reference, Linux
- https://git.kernel.org/stable/c/937282f7d15b593d0be765fa2ced164130ec87f7CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.