What is the CVSS score of CVE-2026-72206?

CVE-2026-72206 has a contested CVSS base score of 9.8 from a third party (e.g. CISA-ADP), while the vendor rates it Critical. vuln.today uses the vendor rating as authoritative.

Which versions of Linux Kernel are affected by CVE-2026-72206?

A critical vulnerability in Linux kernel NTFS filesystem handling (CVE-2026-72206, CVSS 9.8) allows out-of-bounds memory access when systems mount crafted NTFS volumes.. A patch is available.

How to fix or mitigate CVE-2026-72206?

Within 24 hours, inventory Linux systems with NTFS driver support enabled and identify which ones mount untrusted or external NTFS volumes. Within 7 days, obtain vendor-released kernel patches for affected distributions and apply them to non-production test environments to validate stability and compatibility with your workloads. Within 30 days, systematically deploy patched kernel versions across all production Linux systems, prioritizing those that regularly handle external or network-mounted NTFS sources, and verify successful application through system logs and patch-compliance scanning.

Linux Kernel CVE-2026-72206

EUVD-2026-58964 CRITICAL

2026-08-15 416baaa9-dc9f-4396-8d5f-8c081fb06d67

GHSA-4fpm-842r-3pf4

Information Disclosure Linux Red Hat Suse

Critical

Disputed · 9.8 Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Severity by source

Sources disagree (Medium–Critical)

Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.1 HIGH

Requires mounting an attacker-crafted NTFS volume, so AV:L and PR:L (mount capability); an OOB read yields kernel memory disclosure (C:H) and crashes (A:H) with no integrity write (I:N).

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N

SUSE

5.5 MEDIUM

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Red Hat

5.5 MEDIUM

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 17, 2026 - 07:39 vuln.today

CVSS changed

Aug 17, 2026 - 06:22 NVD

9.8 (CRITICAL)

Patch available

Aug 15, 2026 - 07:20 EUVD

CVE Published

Aug 15, 2026 - 06:21 cve.org

CRITICAL 9.8

CVE Published

Aug 15, 2026 - 06:21 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

ntfs: validate index block header more strictly

Modify ntfs_index_block_inconsisent() to perform stricter validation of INDEX_HEADER geometry in INDX blocks, and update ntfs_lookup_inode_by_name() to use that function to validate INDX blocks.

AnalysisAI

Out-of-bounds access in the Linux kernel's legacy NTFS filesystem driver arises from insufficient validation of INDEX_HEADER geometry within INDX directory-index blocks; a crafted NTFS volume can drive ntfs_lookup_inode_by_name() to read past block boundaries. The fix hardens ntfs_index_block_inconsisent() to strictly validate index-block header fields before use, affecting systems that mount attacker-controlled NTFS media. There is no public exploit identified at time of analysis, KEV does not list it, and EPSS is low (0.20%, 10th percentile), consistent with a filesystem-parsing bug that requires a malicious volume rather than remote reach.

Technical ContextAI

The affected component is the Linux kernel's in-tree NTFS driver, which parses on-disk NTFS structures. Directory indexes in NTFS are stored in INDX records, each beginning with an INDEX_HEADER that describes the geometry (entry offsets, allocated/used sizes) of the index entries that follow. The vulnerable code path, ntfs_lookup_inode_by_name(), walked these entries while trusting header fields that were not fully range-checked, so a forged INDEX_HEADER could point entry traversal outside the valid block - a classic out-of-bounds read / memory-safety issue (root cause maps to the CWE-125/CWE-20 family, though the feed lists CWE as N/A). The remediation reuses and strengthens ntfs_index_block_inconsisent() to reject inconsistent INDX geometry up front.

RemediationAI

Upstream fix available (PR/commit); the released patched kernel version is not independently confirmed from the input, so apply your distribution's kernel update that incorporates commits 14bc34fe94 and 34a49b3e94 (https://git.kernel.org/stable/c/14bc34fe948523dc2b0174691f9af9e74eb4f3fd, https://git.kernel.org/stable/c/34a49b3e94a50f45b62c6e6f574f676a079ba23e) rather than trusting the feed's 7.1.5/7.2-rc1 labels. Until patched, reduce exposure by not mounting untrusted NTFS media: disable or restrict removable-media automounting (e.g. tighten udisks/udev policies so unprivileged users cannot auto-mount USB volumes), which trades user convenience for safety; where NTFS support is not needed, blacklist or avoid loading the ntfs module (side effect: legitimate NTFS volumes become unreadable); and restrict physical/USB access on shared or kiosk systems. These controls limit the delivery path for a malicious filesystem but do not fix the underlying parser.

Same technique Information Disclosure

View all

CVE-2019-2725 CRITICAL POC

9.8

CVE-2021-34523 CRITICAL POC

9.0

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

CVE-2014-6324 HIGH POC

8.8

Vendor StatusVendor

SUSE

Severity: Moderate

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 16.0	Not-Affected

CVE-2026-72206 vulnerability details – vuln.today

Back

Linux Kernel CVE-2026-72206

Severity by source

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

Same technique Information Disclosure

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code