Linux Kernel CVE-2026-72202

The vulnerability resides in the Linux kernel's legacy NTFS filesystem driver (ntfs/). The file_ra_state structure governs page-cache readahead when scanning filesystem bitmaps - specifically the free-cluster bitmap in get_nr_free_clusters() and the MFT (Master File Table) bitmap in __get_nr_free_mft_records(). In the vulnerable code, this structure is heap-allocated before the scan begins. A failure of that allocation (e.g., under low-memory or OOM conditions) causes an early return that skips both the NVolFreeClusterKnown() flag publication and the wake_up(&vol->free_waitq) call. Any thread blocked on that waitqueue - waiting to learn the volume's free cluster count - hangs indefinitely with no timeout or recovery path. The fix is to move the file_ra_state to the stack and zero-initialize it (since file_ra_state_init() only sets ra_pages and prev_pos, not the full structure), eliminating the allocation failure path entirely. CWE is listed as N/A; the closest applicable weakness is CWE-400 (Uncontrolled Resource Consumption via indefinite wait) or a missing-wakeup/notification defect. Affected kernel commits span from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 through the fix commits documented in the references.