Linux Kernel CVE-2026-72200

Exploitation requires the target to parse an attacker-controlled NTFS filesystem - specifically a corrupted mapping-pairs runlist for a non-resident attribute whose accumulated LCN reaches S64_MAX before a +1 delta. This means the attacker must get a crafted NTFS image mounted or scanned by the vulnerable kernel: physical/local access to insert removable media, an automount configuration that mounts untrusted USB/removable devices, or a workflow (forensics, backup, file-server) that processes untrusted NTFS volumes. Limiting factors: the system must have NTFS support loaded, must actually mount the malicious volume, and the attack surface is local rather than remote despite the NVD network rating - hosts that never handle untrusted NTFS media are not realistically exposed.

The NVD-supplied CVSS 9.8 vector (AV:N/AC:L/PR:N/UI:N) is inconsistent with the vulnerability class and should be treated with skepticism: NTFS runlist parsing is reached only by mounting or otherwise processing an attacker-controlled NTFS filesystem, which is a local/physical attack surface (crafted USB image, malicious disk, or automount of removable media), not a remote network vector - verify with the vendor before trusting the network rating. All corroborating signals point to low real-world urgency: EPSS is 0.20% (10th percentile), the CVE is not on CISA KEV, and no public exploit is identified at time of analysis. The realistic risk is confined to environments that auto-mount untrusted NTFS media or multi-tenant/forensic systems that process attacker-supplied disk images; for those, a mid-sized operator running kiosk or workstation fleets with USB automount should still patch promptly, while purely server environments that never touch untrusted NTFS volumes can schedule this as routine hygiene. In short, this is a genuine kernel filesystem hardening fix but a low-probability, locally-scoped issue rather than a mass-exploitation threat despite the 9.8 label.

An attacker crafts a malformed NTFS filesystem image whose mapping-pairs runlist drives the signed LCN accumulator to S64_MAX and then adds 1, and delivers it via a USB stick, disk image, or network share that a target host mounts (manually or via automount). When the kernel parses the runlist, the signed overflow makes the driver resolve file runs to attacker-chosen physical clusters, allowing reads of unintended on-disk data or corruption of the volume. No public exploit is identified at time of analysis, and success requires the victim system to actually mount the malicious volume.