{"id":"CVE-2026-72206","state":"PUBLISHED","title":"ntfs: validate index block header more strictly","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nntfs: validate index block header more strictly\n\nModify ntfs_index_block_inconsisent() to perform stricter validation of\nINDEX_HEADER geometry in INDX blocks, and update\nntfs_lookup_inode_by_name() to use that function to validate INDX\nblocks.","publishedAt":"2026-08-15T05:54:02.534Z","updatedAt":"2026-08-18T06:56:26.018Z","severity":{"score":9.8,"label":"Critical","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","source":"Linux"},"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"1e9ea7e04472d4e5e12e58c881eaacfb3e49b669","status":"affected","lessThan":"34a49b3e94a50f45b62c6e6f574f676a079ba23e","versionType":"git"},{"version":"1e9ea7e04472d4e5e12e58c881eaacfb3e49b669","status":"affected","lessThan":"14bc34fe948523dc2b0174691f9af9e74eb4f3fd","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/ntfs/dir.c","fs/ntfs/index.c","fs/ntfs/index.h"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"7.1","status":"affected"},{"version":"0","status":"unaffected","lessThan":"7.1","versionType":"semver"},{"version":"7.1.5","status":"unaffected","lessThanOrEqual":"7.1.*","versionType":"semver"},{"version":"7.2","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/ntfs/dir.c","fs/ntfs/index.c","fs/ntfs/index.h"]}],"references":["https://git.kernel.org/stable/c/34a49b3e94a50f45b62c6e6f574f676a079ba23e","https://git.kernel.org/stable/c/14bc34fe948523dc2b0174691f9af9e74eb4f3fd"],"weaknesses":[],"ingestedAt":"2026-10-29T20:12:58.252Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/72xxx/CVE-2026-72206.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-72206","state":"PUBLISHED","datePublished":"2026-08-15T05:54:02.534Z","dateUpdated":"2026-08-18T06:56:26.018Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2026-08-09T03:40:39.912Z"},"containers":{"cna":{"title":"ntfs: validate index block header more strictly","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nntfs: validate index block header more strictly\n\nModify ntfs_index_block_inconsisent() to perform stricter validation of\nINDEX_HEADER geometry in INDX blocks, and update\nntfs_lookup_inode_by_name() to use that function to validate INDX\nblocks."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"1e9ea7e04472d4e5e12e58c881eaacfb3e49b669","status":"affected","lessThan":"34a49b3e94a50f45b62c6e6f574f676a079ba23e","versionType":"git"},{"version":"1e9ea7e04472d4e5e12e58c881eaacfb3e49b669","status":"affected","lessThan":"14bc34fe948523dc2b0174691f9af9e74eb4f3fd","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/ntfs/dir.c","fs/ntfs/index.c","fs/ntfs/index.h"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"7.1","status":"affected"},{"version":"0","status":"unaffected","lessThan":"7.1","versionType":"semver"},{"version":"7.1.5","status":"unaffected","lessThanOrEqual":"7.1.*","versionType":"semver"},{"version":"7.2","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/ntfs/dir.c","fs/ntfs/index.c","fs/ntfs/index.h"]}],"references":[{"url":"https://git.kernel.org/stable/c/34a49b3e94a50f45b62c6e6f574f676a079ba23e"},{"url":"https://git.kernel.org/stable/c/14bc34fe948523dc2b0174691f9af9e74eb4f3fd"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL"},"scenarios":[{"lang":"en","value":"AV:N - Legacy fs/ntfs registers ntfs_export_ops; remote nfsd/ksmbd LOOKUP or open/stat on an exported crafted NTFS volume reaches ntfs_lookup→ntfs_lookup_inode_by_name INDX B+tree descent without attacker local shell access.\nAC:L - The attacker fully controls on-disk INDX INDEX_HEADER geometry (entries_offset, index_length, allocated_size); pre-fix ntfs_lookup_inode_by_name omitted checks that ntfs_index_block_inconsistent enforced, enabling reliable malformed-index parsing with no race.\nPR:N - Exploitation needs only a malicious NTFS image (USB, loop, dual-boot) mounted by root/udisks2/automount, or NFS/SMB read access to exported paths; no init-namespace root or CAP_SYS_ADMIN on the lookup trigger path.\nUI:N - Automounting removable NTFS or fill_super lookups (e.g. into $Extend/Quota) invoke ntfs_lookup_inode_by_name against index-allocation blocks without further victim action beyond presenting the crafted volume.\nS:U - Out-of-bounds INDX parsing impacts only the host kernel within its filesystem security authority; this is not a VM escape, IOMMU bypass, or cross-sandbox boundary crossing.\nC:H - Missing entries_offset/index_length versus bytes_available validation lets lookup reinterpret INDX header bytes as index entries and read past the index area within the kmalloc page buffer into adjacent kernel memory.\nI:H - The same unchecked INDX geometry is parsed by ntfs_ib_read for write-capable index operations; attacker-steerable header/entry walks can feed later memmove/insert paths and heap corruption beyond the intended index buffer.\nA:H - Crafted INDX entries_offset/length fields can cause infinite index-entry loops, slab/page out-of-bounds reads on malformed walks, or unhandled faults that oops or panic the kernel during directory lookup or mount."}]}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-08-18T06:56:26.018Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"7.1","versionEndExcluding":"7.1.5"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"7.1","versionEndExcluding":"7.2"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}}}}}