What is the CVSS score of CVE-2026-72188?

CVE-2026-72188 has a contested CVSS base score of 9.1 from a third party (e.g. CISA-ADP), while the vendor rates it Critical. vuln.today uses the vendor rating as authoritative.

Which versions of Linux Kernel are affected by CVE-2026-72188?

Linux kernel NTFS filesystem support contains a vulnerability allowing crafted volumes to cause system instability; no public exploit exists at present.. A patch is available.

How to fix or mitigate CVE-2026-72188?

Within 24 hours, identify Linux systems with NTFS driver enabled through kernel inventory and filesystem mount audits. Within 7 days, obtain patches from your Linux distribution's security channel (Red Hat Security Advisories, Ubuntu Security Notice, SUSE Security Updates) and validate in non-production environments. Within 30 days, deploy patched kernels to production; where feasible, disable NTFS driver module on systems not requiring this functionality.

Linux Kernel CVE-2026-72188

EUVD-2026-58946 CRITICAL

2026-08-15 416baaa9-dc9f-4396-8d5f-8c081fb06d67

GHSA-mp9c-j9qx-8x7c

RCE Linux Red Hat Suse

Critical

Disputed · 9.1 Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Severity by source

Sources disagree (Medium–Critical)

Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

vuln.today AI

5.6 MEDIUM

Requires mounting a crafted NTFS image (local, typically privileged or automount, hence AV:L/PR:L/UI:R); impact is corrupted-metadata handling and likely kernel DoS, so A:H with limited integrity and no confidentiality impact.

3.1 AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N

SUSE

5.5 MEDIUM

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Red Hat

5.5 MEDIUM

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 17, 2026 - 07:29 vuln.today

CVSS changed

Aug 17, 2026 - 06:22 NVD

9.1 (CRITICAL)

Patch available

Aug 15, 2026 - 07:20 EUVD

CVE Published

Aug 15, 2026 - 06:21 cve.org

CRITICAL 9.1

CVE Published

Aug 15, 2026 - 06:21 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

ntfs: sanitize MFT references returned from ntfs_lookup_inode_by_name()

ntfs_lookup_inode_by_name() returns MFT references read from directory index entries on disk. These values are untrusted, but the function can currently return an error-marked MFT reference to its callers without validating it.

Callers later decode lookup failures with MREF_ERR(). A crafted NTFS image can set the MREF error bit while leaving the low bits as an arbitrary value, causing callers to consume a bogus pseudo-errno instead of treating the lookup result as corrupted on-disk metadata.

Fix this at the source by normalizing every error-marked MFT reference returned from ntfs_lookup_inode_by_name() to ERR_MREF(-EIO). Apply this to all four directory lookup return paths so every caller gets a validated result without needing additional checks or an API change.

This keeps the sanitization in the common lookup helper, which is cleaner than duplicating validation in each caller.

AnalysisAI

Improper validation of on-disk metadata in the Linux kernel's legacy NTFS driver allows a crafted NTFS filesystem image to smuggle an error-marked MFT (Master File Table) reference back through ntfs_lookup_inode_by_name(), causing directory-lookup callers to misinterpret corrupted disk data as a legitimate pseudo-errno. This affects systems that mount attacker-supplied NTFS volumes; there is no public exploit identified at time of analysis and the EPSS probability is low (0.20%). The upstream fix normalizes any error-marked reference to ERR_MREF(-EIO) so callers can no longer be tricked into consuming a bogus value.

Technical ContextAI

The vulnerability lives in the in-tree NTFS driver (fs/ntfs) of the Linux kernel. NTFS stores directory entries in on-disk index structures that carry MFT references - packed values combining an inode/record number with a sequence number, where the high bit can be set to mark an error. The kernel decodes these with the MREF_ERR() / ERR_MREF() helpers. ntfs_lookup_inode_by_name() reads these references straight from untrusted directory index entries and, before the fix, could hand an error-marked reference (with arbitrary low bits) back to callers across all four lookup return paths. Because callers treat an error-marked reference as an encoded errno, corrupted on-disk metadata gets promoted into a fabricated kernel error code instead of being handled as filesystem corruption. The root cause is a missing sanitization/trust boundary on externally controlled data (conceptually CWE-20 / CWE-345-class improper input validation); the CWE field was not populated in the source data.

RemediationAI

Upstream fix available (commits d97a36bae86a9a4021562ded2987f904e6bcb1d7 and 83f396d881c4fd312c7fd5fff2c157fc21104464 on git.kernel.org); a released patched version is confirmed in the 7.1.5 / 7.2-rc3 range per EUVD, but downstream distribution kernel package versions were not provided, so apply the stable-kernel update offered by your distribution rather than an invented version string. Where immediate patching is not possible, the most effective compensating control is to reduce exposure of the NTFS parser to untrusted media: disable or blacklist the ntfs kernel module if it is not needed (modprobe blacklist / rmmod), disable automatic mounting of removable devices and untrusted images (udisks/autofs policies), and restrict who can mount filesystems by removing user-mount and CAP_SYS_ADMIN grants where feasible. The trade-off is loss of transparent NTFS-on-removable-media support for end users; on servers this is usually acceptable. For systems that must read NTFS, prefer the userspace/ntfs3-based path per your distribution's guidance and avoid mounting images from untrusted sources. See the kernel.org commit links above for the definitive change.

Same technique RCE

View all

CVE-2021-44228 CRITICAL POC

10.0

CVE-2017-7269 CRITICAL POC

9.8

CVE-2022-47966 CRITICAL POC

9.8

CVE-2012-4681 CRITICAL POC

9.8

CVE-2023-3519 CRITICAL POC

9.8

CVE-2015-5119 CRITICAL POC

9.8

CVE-2016-4117 CRITICAL POC

9.8

CVE-2015-3113 CRITICAL POC

9.8

Vendor StatusVendor

SUSE

Severity: Moderate

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 16.0	Not-Affected

CVE-2026-72188 vulnerability details – vuln.today

Back

Linux Kernel CVE-2026-72188

Severity by source

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

Same technique RCE

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code