What is the CVSS score of CVE-2026-72201?

CVE-2026-72201 has a contested CVSS base score of 9.8 from a third party (e.g. CISA-ADP), while the vendor rates it Critical. vuln.today uses the vendor rating as authoritative.

Which versions of Linux Kernel are affected by CVE-2026-72201?

The Linux kernel NTFS filesystem driver contains a critical validation flaw that could trigger kernel crashes or data exposure when processing malformed or attacker-controlled storage volumes.. A patch is available.

How to fix or mitigate CVE-2026-72201?

Within 24 hours, identify and inventory all Linux systems utilizing the NTFS filesystem driver; verify current kernel versions and review mount configurations for untrusted storage sources. Within 7 days, begin staged testing and deployment of kernel updates containing the CVE-2026-72201 patch in non-production environments to validate stability. Within 30 days, complete deployment of patched kernel versions across all affected production systems, prioritizing servers accessing NTFS-formatted storage.

Linux Kernel CVE-2026-72201

EUVD-2026-58959 CRITICAL

2026-08-15 416baaa9-dc9f-4396-8d5f-8c081fb06d67

GHSA-689w-8rx2-mjx7

Information Disclosure Linux Red Hat Suse

Critical

Disputed · 9.8 Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Severity by source

Sources disagree (Medium–Critical)

Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.1 HIGH

Triggered by mounting/reading an attacker-supplied NTFS volume, so AV:L and PR:L; out-of-bounds read yields memory disclosure (C:H) and possible crash (A:H) but no integrity write.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N

SUSE

5.5 MEDIUM

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Red Hat

5.5 MEDIUM

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 17, 2026 - 07:36 vuln.today

CVSS changed

Aug 17, 2026 - 06:22 NVD

9.8 (CRITICAL)

Patch available

Aug 15, 2026 - 07:20 EUVD

CVE Published

Aug 15, 2026 - 06:21 cve.org

CRITICAL 9.8

CVE Published

Aug 15, 2026 - 06:21 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

ntfs: validate index entries on reading

Validate index entries immediately after reading an index root or index block from disk. This eliminates repeated checks in lookup and readdir, and reduce the risk of missing checks in those paths.

AnalysisAI

Improper validation of NTFS index entries in the Linux kernel's NTFS filesystem driver allows a crafted or corrupted NTFS volume to be processed without adequate bounds checking during index root and index block reads. When an attacker-controlled NTFS image is mounted and traversed (lookup/readdir), missing per-read validation can lead to out-of-bounds memory access, enabling information disclosure or a kernel crash. No public exploit identified at time of analysis; EPSS is low (0.20%, 10th percentile) and the issue is not on the CISA KEV list.

Technical ContextAI

The vulnerability lives in the in-kernel NTFS filesystem implementation, which parses on-disk B-tree directory structures composed of an index root and one or more index blocks, each containing a sequence of index entries. Prior to the fix, individual index entries were not consistently validated at the point of reading a root/block from disk; validation was scattered across the lookup and readdir code paths, creating the risk that a malformed entry (bad length, offset, or key size fields) could be trusted and dereferenced. The remediation moves validation to occur immediately after an index root or index block is read, so every downstream consumer operates on already-sanitized data. CWE is not assigned in the source data, but the root-cause class is improper validation of array/structure index or length fields (CWE-129/CWE-125-style out-of-bounds read) in untrusted filesystem metadata.

RemediationAI

Update to a patched Linux kernel that includes the fix - the stable series build 7.1.5 or the 7.2-rc1 development build per the EUVD data - and rebuild/reboot; distribution users should apply the vendor kernel update that backports commits 2221b691d7b2 and e2b95d3adb55 (https://git.kernel.org/stable/c/2221b691d7b2e17f08153f95848dacaa5d87e21d and https://git.kernel.org/stable/c/e2b95d3adb558ddd5685f9e072ec8661d57ee3a9). Where immediate patching is not possible, the effective compensating control is to prevent parsing of untrusted NTFS volumes: disable automatic mounting of removable media (e.g., stop udisks/autofs auto-mount rules), avoid mounting NTFS images or USB devices from untrusted sources, and if the NTFS driver is unneeded, blacklist the module (blacklist ntfs3/ntfs) so crafted volumes cannot be processed - the trade-off is loss of NTFS read/write support for legitimate Windows-formatted media.

Same technique Information Disclosure

View all

CVE-2019-2725 CRITICAL POC

9.8

CVE-2021-34523 CRITICAL POC

9.0

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

CVE-2014-6324 HIGH POC

8.8

Vendor StatusVendor

SUSE

Severity: Moderate

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 16.0	Not-Affected

CVE-2026-72201 vulnerability details – vuln.today

Back

Linux Kernel CVE-2026-72201

Severity by source

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

Same technique Information Disclosure

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code