Skip to main content

Linux Kernel CVE-2026-72194

| EUVDEUVD-2026-58952 CRITICAL
2026-08-15 416baaa9-dc9f-4396-8d5f-8c081fb06d67 GHSA-hqq4-5743-j5rq
Buffer Overflow Linux Red Hat Suse
Critical
Disputed · 9.8 Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Share

Severity by source

Sources disagree (Medium–Critical)
Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY
9.8 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
4.6 MEDIUM

Requires physically attaching a malicious NTFS volume so AV:P; no auth beyond mounting (PR:N); impact is a kernel panic only, so C:N/I:N/A:H.

3.1 AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Red Hat
5.5 MEDIUM
qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Aug 17, 2026 - 07:30 vuln.today
CVSS changed
Aug 17, 2026 - 06:22 NVD
9.8 (CRITICAL)
Patch available
Aug 15, 2026 - 07:20 EUVD
CVE Published
Aug 15, 2026 - 06:21 cve.org
CRITICAL 9.8
CVE Published
Aug 15, 2026 - 06:21 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

fs/ntfs3: add depth limit to indx_find_buffer to prevent stack overflow

indx_find_buffer() recursively descends the B+ tree index with no depth limit. A crafted NTFS image with circular index node references causes unbounded recursion, overflowing the kernel stack and panicking the system.

This is reachable by mounting a malicious NTFS filesystem (e.g. from a USB drive via desktop automount) and deleting a file whose index entry triggers the rebalancing fallback path in indx_delete_entry().

Add a depth parameter and bail out with -EINVAL when it reaches the fnd->nodes array bound, matching the constraint already enforced by fnd_push() in indx_find().

The related function indx_find() was previously patched for a similar infinite-loop issue (commit 1732053c8a6b), but indx_find_buffer() was missed.

AnalysisAI

Denial-of-service in the Linux kernel ntfs3 driver lets an attacker with the ability to mount a crafted NTFS image panic the system via unbounded recursion. indx_find_buffer() descends the NTFS B+ tree index with no depth limit, so a circular index-node reference overflows the kernel stack when a file deletion hits the index rebalancing fallback path. No public exploit is identified and it is not in CISA KEV; EPSS is low at 0.23%. Note that the supplied CVSS 9.8/AV:N vector is inconsistent with the description, which requires local access to attach a malicious filesystem.

Technical ContextAI

The flaw is in fs/ntfs3, the in-kernel NTFS read/write driver (mainlined since Linux 5.15). NTFS stores directory indexes as B+ trees of index nodes; indx_find_buffer() walks this tree recursively. Unlike indx_find(), which enforces a depth bound through fnd_push() against the fnd->nodes array, indx_find_buffer() had no such limit. The root cause is CWE-674 (uncontrolled recursion) leading to CWE-121-style kernel stack exhaustion; the input's 'Buffer Overflow' tag refers to this stack overflow. A forged on-disk structure with circular node references makes the recursion never terminate. The fix adds a depth parameter and returns -EINVAL at the fnd->nodes bound, mirroring indx_find()'s existing constraint; a sibling loop bug in indx_find() was previously fixed in commit 1732053c8a6b, but this recursive path was missed.

RemediationAI

Vendor-released patch: update to a fixed stable kernel - 5.15.212, 6.1.178, 6.6.145, 6.12.97, 6.18.40, or 7.1.5 (fix also in 7.2-rc1) - matching your kernel series, then reboot; apply your distribution's corresponding backported package as it ships. Where immediate patching is not possible, the most effective compensating control is to stop untrusted NTFS volumes from being auto-mounted: disable desktop/udisks automount for removable media (trade-off: users must mount manually), or blacklist/avoid the ntfs3 driver on systems that never legitimately handle NTFS (trade-off: loses NTFS read/write support). On managed endpoints, restrict physical USB access or enforce USBGuard-style allowlisting (trade-off: administrative overhead for legitimate device use). Verify commits and affected ranges via the git.kernel.org stable references listed for this CVE.

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

CVE-2026-72194 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy