What is the CVSS score of CVE-2026-72208?

CVE-2026-72208 has a contested CVSS base score of 9.8 from a third party (e.g. CISA-ADP), while the vendor rates it Critical. vuln.today uses the vendor rating as authoritative.

Which versions of Linux Kernel are affected by CVE-2026-72208?

A critical out-of-bounds read vulnerability in the Linux kernel NTFS driver (CVE-2026-72208) allows local attackers to leak sensitive kernel memory or trigger system crashes when processing malicious…. A patch is available.

How to fix or mitigate CVE-2026-72208?

Within 24 hours, inventory all systems running the Linux NTFS driver and assess workload sensitivity; prioritize systems accessible to multiple users or hosting cryptographic material. Within 7 days, apply the vendor-released patch across production systems, staging first to validate kernel stability in your environment. Within 30 days, complete patching of all remaining systems and enable audit logging to monitor NTFS file system operations for unusual activity.

Linux Kernel CVE-2026-72208

EUVD-2026-58966 CRITICAL

2026-08-15 416baaa9-dc9f-4396-8d5f-8c081fb06d67

GHSA-6v96-8w62-7ppx

Information Disclosure Linux Red Hat Suse

Critical

Disputed · 9.8 Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Severity by source

Sources disagree (Medium–Critical)

Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.1 HIGH

Reachable only by parsing an attacker-supplied NTFS volume (local, low-privilege mount/access), so AV:L/PR:L; out-of-bounds read yields memory disclosure (C:H) and possible panic (A:H) but no integrity impact (I:N).

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N

SUSE

5.5 MEDIUM

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Red Hat

5.5 MEDIUM

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 17, 2026 - 07:41 vuln.today

CVSS changed

Aug 17, 2026 - 06:22 NVD

9.8 (CRITICAL)

Patch available

Aug 15, 2026 - 07:20 EUVD

CVE Published

Aug 15, 2026 - 06:21 cve.org

CRITICAL 9.8

CVE Published

Aug 15, 2026 - 06:21 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

ntfs: add bounds check before accessing EA entries

in ntfs_ea_lookup and ntfs_listxattr, this verifies that there is enough space in the EA entry before accessing the next_entry_offset field of the EA entry.

AnalysisAI

Out-of-bounds read in the Linux kernel's NTFS driver allows a local attacker to leak adjacent kernel memory or crash the system by parsing extended attribute (EA) entries on a crafted NTFS volume. The ntfs_ea_lookup and ntfs_listxattr routines dereferenced the next_entry_offset field of an EA entry without first verifying that enough space remained in the buffer. No public exploit identified at time of analysis; EPSS is low (0.20%, 10th percentile) and the issue is tagged as Information Disclosure rather than code execution.

Technical ContextAI

The flaw lives in the Linux kernel NTFS filesystem driver, in its handling of on-disk extended attributes. NTFS stores EAs as a chain of variable-length entries, each carrying a next_entry_offset field used to walk to the following entry. In ntfs_ea_lookup (used to resolve a named EA) and ntfs_listxattr (backing the listxattr(2) syscall), the code advanced through this chain and read next_entry_offset without confirming that the current entry's declared size actually fit within the remaining EA buffer. A crafted volume with a truncated or malformed final entry therefore causes a read past the end of the buffer. This is a classic out-of-bounds read / missing-bounds-check bug (CWE-125 class; the record lists CWE as N/A), where untrusted, attacker-controlled on-disk metadata is trusted for length arithmetic before validation.

RemediationAI

Vendor-released patch: upgrade to Linux 7.1.5 (or 7.2-rc1 / later), which add the missing bounds check before dereferencing the EA next_entry_offset field; distribution users should apply the equivalent backported stable-kernel update from their vendor. Apply the fix by taking the stable commits 937282f7d15b593d0be765fa2ced164130ec87f7 and d9d9925de1d8f233cc60d3dc356e12f232f97c15 (https://git.kernel.org/stable/c/937282f7d15b593d0be765fa2ced164130ec87f7). Where patching must be deferred, reduce exposure by preventing untrusted NTFS volumes from being parsed: disable automatic mounting of removable media (for example turn off udisks/GNOME auto-mount), avoid loading or blacklist the NTFS kernel module on systems that do not need it, and restrict who can mount filesystems (avoid user/nosuid mount options for untrusted media) - the trade-off is loss of convenient USB/NTFS interoperability for affected users and workflows.

Same technique Information Disclosure

View all

CVE-2019-2725 CRITICAL POC

9.8

CVE-2021-34523 CRITICAL POC

9.0

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

CVE-2014-6324 HIGH POC

8.8

Vendor StatusVendor

SUSE

Severity: Moderate

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 16.0	Not-Affected

CVE-2026-72208 vulnerability details – vuln.today

Back

Linux Kernel CVE-2026-72208

Severity by source

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

Same technique Information Disclosure

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code