What is the CVSS score of CVE-2026-72197?

CVE-2026-72197 has a CVSS 3.1 base score of 8.4 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Linux Kernel are affected by CVE-2026-72197?

The Linux kernel's ntfs3 filesystem driver contains a memory corruption vulnerability (CVE-2026-72197, CVSS 8.4) allowing local users to crash systems and potentially escalate privileges by mounting…. A patch is available.

How to fix or mitigate CVE-2026-72197?

Within 24 hours, inventory Linux systems with ntfs3 enabled and identify which permit unprivileged NTFS mounting-this determines criticality tier. Within 7 days, obtain the patched kernel version from your distribution vendor (Red Hat, Ubuntu, SUSE, etc.), validate in staging environments, and deploy to production systems, prioritizing those with permissive mount policies. Within 30 days, verify patch installation across all affected hosts and audit mount capabilities via AppArmor or SELinux policies to restrict NTFS mounting to authorized administrators only.

Linux Kernel CVE-2026-72197

EUVD-2026-58955 HIGH

2026-08-15 416baaa9-dc9f-4396-8d5f-8c081fb06d67

GHSA-j9fv-qm2v-gr26

Information Disclosure Linux Red Hat Suse

8.4

CVSS 3.1 · Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Severity by source

Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY

8.4 HIGH

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.4 HIGH

Local vector confirmed by mount-triggered exploit path; PR:N applies where unprivileged user namespace mounts are default-enabled; all three impacts high from kernel OOB write.

3.1 AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

5.1 MEDIUM

AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H

Red Hat

5.5 MEDIUM

qualitative

Primary rating from Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67).

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 17, 2026 - 07:32 vuln.today

CVSS changed

Aug 17, 2026 - 06:22 NVD

8.4 (HIGH)

Patch available

Aug 15, 2026 - 07:20 EUVD

CVE Published

Aug 15, 2026 - 06:21 cve.org

HIGH 8.4

CVE Published

Aug 15, 2026 - 06:21 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

fs/ntfs3: bound DeleteIndexEntryAllocation memmove length

In do_action()'s DeleteIndexEntryAllocation case, e->size comes from an on-disk INDEX_BUFFER entry. When e->size makes e + e->size point past hdr + hdr->used, PtrOffset(e1, Add2Ptr(hdr, used)) returns a negative ptrdiff_t that is silently cast to a quasi-infinite size_t when passed to memmove(). The memmove then walks past the destination buffer.

The sibling DeleteIndexEntryRoot case at fslog.c:3540-3543 already carries the corresponding guard:

if (PtrOffset(e1, Add2Ptr(hdr, used)) < esize || Add2Ptr(e, esize) > Add2Ptr(lrh, rec_len) || used + esize > le32_to_cpu(hdr->total)) { goto dirty_vol; }

Apply the same shape to the allocation-path case. Also reject esize == 0: memmove(e, e, ...) is a no-op and leaves hdr->used unchanged, hiding a malformed entry from the existing check_index_header() walk.

Reproduced under UML+KASAN on mainline 8d90b09e6741 by mounting a crafted NTFS image: the unguarded memmove takes a length of 0xffffffffffffff00 and the kernel oopses in memmove+0x81/0x1a0 on the do_action+0x36a2 frame.

[almaz.alexandrovich@paragon-software.com: clang-formatted the changes]

AnalysisAI

Linux kernel's ntfs3 filesystem driver crashes and may corrupt memory when processing a crafted NTFS image due to an unbounded memmove in the DeleteIndexEntryAllocation code path. Any local user able to mount a malformed NTFS volume can trigger a kernel oops through a negative ptrdiff_t silently cast to a near-maximal size_t, causing memmove to walk far past the destination buffer. No public exploit and no CISA KEV listing exist at time of analysis; EPSS is low at 0.21%, but the memory corruption primitive and local-to-kernel boundary crossing make this a meaningful privilege escalation and availability risk on systems where unprivileged NTFS mounts are possible.

Technical ContextAI

The ntfs3 driver (merged in Linux 5.15) handles NTFS journal replay through do_action() in fs/ntfs3/fslog.c. The DeleteIndexEntryAllocation case reads e->size directly from an on-disk INDEX_BUFFER record without validating that e plus e->size stays within the header's used region. PtrOffset(e1, Add2Ptr(hdr, hdr->used)) can return a negative ptrdiff_t when a crafted e->size pushes the pointer past the buffer boundary; this negative value is silently promoted to a near-maximal size_t (demonstrated value 0xffffffffffffff00) when passed to memmove, causing an out-of-bounds write. An analogous guard already exists for the DeleteIndexEntryRoot sibling path at fslog.c:3540-3543, confirming the fix shape is known. A secondary rejection of esize==0 is also applied to prevent a no-op memmove from hiding malformed entries from check_index_header(). CWE is not assigned in NVD; the root cause class is an integer/type confusion (signed-to-unsigned implicit cast) leading to a heap/stack buffer overflow in kernel memory. Affected CPEs span the ntfs3 subsystem across all kernel branches that include the driver, from 5.15 through the 7.x development tree.

RemediationAI

Upgrade the Linux kernel to a patched stable release: 5.15.212, 6.1.178, 6.6.145, 6.12.97, 6.18.40, 7.1.5, or 7.2-rc1 as appropriate for the running branch. Patch commits are available at git.kernel.org/stable (see references for per-branch SHAs). Distribution-packaged kernels (Ubuntu, RHEL, Debian, SUSE) should be updated via the standard package manager once vendor-specific packages incorporating these commits are released; check each vendor's security advisory portal for package availability. As a compensating control where immediate kernel upgrade is not feasible, disable unprivileged user namespace mounts to prevent local users from mounting crafted NTFS images without elevated privileges: set kernel.unprivileged_userns_clone=0 on Ubuntu/Debian-based systems or kernel.unprivileged_userns_clone=0 via sysctl; note this breaks sandboxed applications (Flatpak, snap, Chrome namespaced renderer) that rely on user namespaces. Alternatively, remove or blacklist the ntfs3 kernel module (modprobe -r ntfs3 and add ntfs3 to /etc/modprobe.d/blacklist.conf) if NTFS mounting is not required; this blocks all ntfs3 functionality including legitimate NTFS volume access. Systems where only root mounts NTFS are substantially less exposed regardless of CVSS PR:N.

Same technique Information Disclosure

View all

CVE-2019-2725 CRITICAL POC

9.8

CVE-2021-34523 CRITICAL POC

9.0

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

CVE-2014-6324 HIGH POC

8.8

Vendor StatusVendor

SUSE

Severity: Moderate

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 16.0	Not-Affected

CVE-2026-72197 vulnerability details – vuln.today

Back

Linux Kernel CVE-2026-72197

Severity by source

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

Same technique Information Disclosure

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code