Skip to main content

Linux Kernel CVE-2026-72200

| EUVDEUVD-2026-58958 CRITICAL
2026-08-15 416baaa9-dc9f-4396-8d5f-8c081fb06d67 GHSA-j9wr-x478-q66c
Buffer Overflow Linux Red Hat Suse
Critical
Disputed · 9.8 Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Share

Severity by source

Sources disagree (Medium–Critical)
Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY
9.8 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
7.8 HIGH

Reachable only by mounting an attacker-supplied NTFS volume, so AV:L and PR:L (mount privilege/local media); redirected cluster access yields high confidentiality, integrity, and availability impact in kernel context.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
6.6 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H
Red Hat
5.5 MEDIUM
qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Aug 17, 2026 - 07:35 vuln.today
CVSS changed
Aug 17, 2026 - 06:22 NVD
9.8 (CRITICAL)
Patch available
Aug 15, 2026 - 07:20 EUVD
CVE Published
Aug 15, 2026 - 06:21 cve.org
CRITICAL 9.8
CVE Published
Aug 15, 2026 - 06:21 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

ntfs: detect mapping-pairs LCN accumulator overflow

The NTFS mapping-pairs parser accumulates relative LCN deltas in a signed integer. A corrupted attribute can drive that addition past the representable range.

One corrupt runlist shape sets the accumulated LCN to S64_MAX and then adds a delta of 1 in the next mapping-pairs entry.

Signed overflow is undefined and can turn an invalid runlist into a different set of physical clusters.

Check the LCN addition for overflow before storing the next run.

AnalysisAI

Signed-integer overflow in the Linux kernel NTFS driver's mapping-pairs runlist parser lets a crafted or corrupted NTFS volume redirect logical-to-physical cluster mappings to unintended disk locations. The flaw affects the kernel's NTFS attribute parsing when it accumulates relative LCN deltas; a malicious runlist can set the accumulator to S64_MAX and add 1, triggering undefined behavior that resolves runs to a different set of physical clusters. Fixed upstream in Linux 7.1.5 and 7.2-rc1; no public exploit is identified at time of analysis and EPSS exploitation probability is low (0.20%).

Technical ContextAI

NTFS stores non-resident attribute data as a runlist encoded in 'mapping pairs', where each entry carries a run length and a relative LCN (Logical Cluster Number) delta from the previous run. The kernel driver decodes these deltas by accumulating them into a signed 64-bit integer to compute each run's absolute starting cluster. Because the accumulator is signed, a corrupted attribute that pushes the running total past S64_MAX triggers signed-integer overflow - undefined behavior in C (CWE-190, Integer Overflow / Wraparound; the input's 'Buffer Overflow' tag is imprecise). The consequence is not a classic memory overflow but a semantic one: the parser produces valid-looking runs that point at physical clusters the attacker chose, enabling reads or writes against unintended on-disk data. The fix adds an explicit overflow check on the LCN addition before storing each run.

RemediationAI

Apply the vendor-released patch by upgrading to Linux 7.1.5 or 7.2-rc1 (or your distribution's backported kernel carrying commits 7fb64788812d and ec4f061f2219), then reboot to load the fixed kernel; the fix simply adds an overflow guard on the LCN accumulator and has no functional side effects on legitimate NTFS volumes. Where immediate patching is not possible, reduce exposure with concrete compensating controls: disable automatic mounting of removable/NTFS media (e.g., stop or mask udisks2 automount, or set udev rules to not auto-mount untrusted devices) - trade-off is manual effort for users who legitimately use NTFS USB drives; blacklist the ntfs/ntfs3 kernel module on systems that never need NTFS (echo 'blacklist ntfs3' to modprobe.d) - trade-off is loss of NTFS read/write entirely; and restrict who can mount filesystems by avoiding user_allow_other / user mount options in fstab. Reference the upstream commits above for exact code changes.

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Not-Affected

Share

CVE-2026-72200 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy