What is the CVSS score of CVE-2026-72354?

CVE-2026-72354 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Linux Kernel are affected by CVE-2026-72354?

CVE-2026-72354 affects Linux 7.1.0-7.1.4 with NTFS filesystem support and requires local system access; no public exploit identified at time of analysis.. A patch is available.

How to fix or mitigate CVE-2026-72354?

Within 24 hours, audit infrastructure to identify systems running Linux 7.1.0 through 7.1.4, particularly those with NTFS filesystem support enabled. Within 7 days, validate and test kernel updates to version 7.1.5 or 7.2-rc3 in a staging environment to confirm stability. Within 30 days, deploy the patched kernel across all affected systems and verify successful updates through patch compliance monitoring.

Linux Kernel CVE-2026-72354

EUVD-2026-59253 HIGH

2026-08-15 Linux

GHSA-2cmf-w788-qhmg

Information Disclosure Linux Red Hat Suse

8.8

CVSS 3.1 · Vendor: Linux

Severity by source

Vendor (Linux) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.0 HIGH

AV:L because exploitation requires local filesystem access; AC:H for required race condition timing; PR:L as unprivileged file-creation triggers the vulnerable MFT allocation path.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

5.3 MEDIUM

AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H

Red Hat

5.5 MEDIUM

qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 17, 2026 - 08:43 vuln.today

CVSS changed

Aug 17, 2026 - 06:22 NVD

8.8 (HIGH)

Patch available

Aug 15, 2026 - 07:20 EUVD

CVE Published

Aug 15, 2026 - 05:55 cve.org

UNKNOWN (no severity yet)

CVE Published

Aug 15, 2026 - 05:55 cve.org

HIGH 8.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

ntfs: avoid stale runlist element dereference in MFT writeback

ntfs_write_mft_block() maps each $MFT record through the $MFT data runlist. For sub-folio clusters it looks up a struct runlist_element under ni->runlist.lock, drops the lock, and later uses rl->length and rl->vcn when choosing folio_sz.

That pointer is only borrowed from ni->runlist.rl. Concurrent $MFT allocation extension can merge a replacement runlist under the same lock, and ntfs_rl_realloc() can free the old backing array. If that happens between the lookup and the later folio_sz decision, writeback can dereference freed runlist storage.

The buggy scenario involves two paths, with each column showing the order within that path:

MFT writeback path: $MFT allocation extension:

Look up rl under 1. Extend the $MFT data allocation.

ni->runlist.lock. 2. Publish a replacement runlist.

Drop ni->runlist.lock. 3. Free the old runlist array.
Read rl->length and rl->vcn

to choose folio_sz.

Compute the remaining run length while ni->runlist.lock is still held, and use that scalar after unlock. This preserves the existing folio sizing decision without carrying a borrowed runlist_element across the lock boundary.

Validation reproduced this kernel report: BUG: KASAN: slab-use-after-free in ntfs_mft_writepages+0x1c8d/0x1fb0

Call Trace: <TASK> dump_stack_lvl+0x66/0xa0 print_report+0xce/0x630 ? ntfs_mft_writepages+0x1c8d/0x1fb0 ? srso_alias_return_thunk+0x5/0xfbef5 ? __virt_addr_valid+0x20d/0x410 ? ntfs_mft_writepages+0x1c8d/0x1fb0 kasan_report+0xe0/0x110 ? ntfs_mft_writepages+0x1c8d/0x1fb0 ntfs_mft_writepages+0x1c8d/0x1fb0 ? __pfx_ntfs_mft_writepages+0x10/0x10 ? __pfx___mutex_unlock_slowpath+0x10/0x10 ? srso_alias_return_thunk+0x5/0xfbef5 ? iput+0x92/0xa80 do_writepages+0x219/0x530 ? __pfx_do_writepages+0x10/0x10 __writeback_single_inode+0x117/0xf50 ? do_raw_spin_lock+0x130/0x270 ? __pfx_do_raw_spin_lock+0x10/0x10 ? __pfx___writeback_single_inode+0x10/0x10 ? srso_alias_return_thunk+0x5/0xfbef5 writeback_sb_inodes+0x65b/0x1810 ? srso_alias_return_thunk+0x5/0xfbef5 ? lock_acquire+0x2b8/0x2f0 ? __pfx_writeback_sb_inodes+0x10/0x10 ? lock_release+0x1e0/0x280 ? _raw_spin_unlock+0x23/0x40 ? move_expired_inodes+0x2b8/0x850 __writeback_inodes_wb+0xf4/0x270 ? __pfx___writeback_inodes_wb+0x10/0x10 ? srso_alias_return_thunk+0x5/0xfbef5 ? queue_io+0x2e4/0x410 wb_writeback+0x666/0x880 ? srso_alias_return_thunk+0x5/0xfbef5 ? __pfx_wb_writeback+0x10/0x10 ? srso_alias_return_thunk+0x5/0xfbef5 ? srso_alias_return_thunk+0x5/0xfbef5 ? get_nr_dirty_inodes+0x1c/0x170 wb_workfn+0x75e/0xbb0 ? srso_alias_return_thunk+0x5/0xfbef5 ? _raw_spin_unlock_irqrestore+0x27/0x60 ? __pfx_wb_workfn+0x10/0x10 ? __pfx_debug_object_deactivate+0x10/0x10 ? lock_acquire+0x2b8/0x2f0 ? srso_alias_return_thunk+0x5/0xfbef5 ? lock_release+0x1e0/0x280 process_one_work+0x8d0/0x1870 ? __pfx_process_one_work+0x10/0x10 ? srso_alias_return_thunk+0x5/0xfbef5 worker_thread+0x575/0xf80 ? __pfx_worker_thread+0x10/0x10 kthread+0x2e7/0x3c0 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x576/0x810 ? __pfx_ret_from_fork+0x10/0x10 ? srso_alias_return_thunk+0x5/0xfbef5 ? __switch_to+0x57e/0xe10 ? __switch_to_asm+0x33/0x70 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1a/0x30 </TASK>

Allocated by task 970: kasan_save_stack+0x33/0x60 kasan_save_track+0x14/0x30 __kasan_kmalloc+0xaa/0xb0 __kvmalloc_node_noprof+0x353/0x920 ntfs_rl_realloc+0x3c/0x80 ntfs_runlists_merge+0x1212/0x3010 ntfs_mft_data_extend_allocation_nolock+0x3e0/0x1f40 ntfs_mft_record_alloc+0x1ab4/0x4f10 __ntfs_create+0x680/0x2e50 ntfs_create+0x1e6/0x3a0 path_openat+0x2b55/0x3c10 do_file_open+0x1f4/0x460 do_sys_openat2+0xde/0x170 __x64_sys_openat+0x122/0x1e0 do_syscall_64+0x115/0x6a0 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Freed by task 1294: kasan_save_ ---truncated---

AnalysisAI

Use-after-free in the Linux kernel's legacy NTFS filesystem driver (ntfs_mft_writepages) allows a local low-privileged attacker to corrupt kernel slab memory by winning a timing race between MFT writeback and concurrent MFT allocation extension. Affected kernels span the Linux 7.1 stable series up through 7.1.4; fix commits are confirmed in the upstream stable tree targeting 7.1.5 and 7.2-rc3. No public exploit is identified at time of analysis and EPSS is low (0.20%), but the confirmed slab-use-after-free in ring-0 writeback code represents a high-severity memory safety defect warranting scheduled patching.

Technical ContextAI

The affected component is the legacy NTFS filesystem driver (fs/ntfs/) in the Linux kernel, distinct from the newer ntfs3 driver. The root cause is a lock-boundary use-after-free (CWE-416): ntfs_write_mft_block() acquires ni->runlist.lock to obtain a struct runlist_element pointer (rl) from the inode's runlist array, releases the lock, and subsequently reads rl->length and rl->vcn to compute folio_sz. Concurrently, ntfs_mft_data_extend_allocation_nolock()-triggered during MFT record allocation (e.g., via ntfs_create on file open)-calls ntfs_runlists_merge() to publish a replacement runlist and ntfs_rl_realloc() to free the old backing array. If the free occurs between the lock drop and the rl field reads, writeback dereferences freed slab storage. The KASAN report embedded in the CVE description confirms slab-use-after-free at ntfs_mft_writepages+0x1c8d/0x1fb0, with allocation traced to ntfs_rl_realloc via ntfs_runlists_merge and free attributed to a separate kernel worker task. CPE: cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:*.

RemediationAI

The primary fix is to upgrade to Linux kernel 7.1.5 or later in the 7.1 stable series, or 7.2-rc3 or later in the mainline series. The upstream patch resolves the issue by computing the remaining run length as a scalar while ni->runlist.lock is still held, eliminating the stale pointer dereference after unlock; this preserves existing folio sizing logic without carrying a borrowed runlist_element across the lock boundary. Distribution maintainers should apply the stable-tree commits at https://git.kernel.org/stable/c/9a2e36963a3fc52401586657d34e3f1c5a01ea56 and https://git.kernel.org/stable/c/81fe702ff1760da32bcd3ef4494b2a33dbeced72. If immediate kernel patching is not feasible, blacklisting or unloading the legacy ntfs module (via 'rmmod ntfs' or adding 'blacklist ntfs' to modprobe configuration) eliminates the attack surface entirely at the cost of losing NTFS mount capability - workloads requiring NTFS access would need to migrate to the ntfs3 driver, which is not affected by this issue. A weaker compensating control is to restrict NTFS mount permissions to root-only through mount namespace policies or udev rules, limiting which users can trigger concurrent MFT operations, though this does not eliminate the race in root-accessible workloads.

Same technique Information Disclosure

View all

CVE-2019-2725 CRITICAL POC

9.8

CVE-2021-34523 CRITICAL POC

9.0

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

CVE-2014-6324 HIGH POC

8.8

Vendor StatusVendor

SUSE

Severity: Moderate

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 16.0	Not-Affected

CVE-2026-72354 vulnerability details – vuln.today

Back

Linux Kernel CVE-2026-72354

Severity by source

CVSS VectorVendor: Linux

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

Same technique Information Disclosure

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code