Linux Kernel CVE-2026-72186

The affected component is the in-kernel NTFS filesystem driver. NTFS stores its own bookkeeping in reserved 'system files' (inodes below FILE_first_user) such as $Bitmap (the cluster allocation bitmap), $MFT, and $LogFile. The show_sys_files mount option surfaces these normally-hidden metadata inodes into the visible namespace so they can be opened like ordinary files. The driver relies on these inodes' page cache internally - the cluster allocator reads $Bitmap through the very same inode - so allowing a userspace write() through the VFS path both mutates driver-managed on-disk structures and re-enters the folio locking the driver already holds, producing a deadlock. No CWE was assigned (N/A), but the root-cause classes are improper locking / re-entrant folio lock (CWE-667-style) and unprotected modification of internal state (missing enforcement that driver-owned metadata is not user-writable). The fix marks these base metadata files immutable at inode-read time so the VFS rejects write, mmap, truncate, and unlink with -EPERM, while skipping directories so root and $Extend stay usable.