CVE-2026-72185

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the NTFS driver where the ntfs map runlist nolock() function fails to properly validate attribute types. When the function looks up an attribute extent for a target VCN (Virtual Cluster Number) and ctx needs reset is true, it calls ntfs attr lookup() expecting a non-resident attribute. A specially crafted NTFS image can provide a resident attribute instead, causing the system to access the wrong union member a->data.non resident.highest vcn. This leads to a corruption of the VCN range check. The execution path triggering this during mount involves the functions ntfs fill super(), load system files(), ntfs empty logfile(), and ntfs map runlist nolock().

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.