Linux Kernel CVE-2026-72470

Exploitation requires local authenticated access (CVSS PR:L) with the ability to mount filesystems - either directly as root, via sudo, through a permissive udisks2/automount policy, or via user namespace mounts where allowed by the kernel configuration. The NTFS volume being mounted must be dirty, meaning it was not cleanly unmounted and retains a valid $LogFile restart area. Critically, the on-disk sys_page_size recorded in that restart area must be larger than the mounting host's PAGE_SIZE (e.g., a 64K log page on a host with 4K PAGE_SIZE); this condition does not arise with NTFS volumes formatted and normally used on matching-page-size hosts. The ntfs3 kernel module must be loaded and selected over the legacy ntfs driver. Factors limiting exploitation: the requirement to supply or control a specifically crafted NTFS volume, the page-size mismatch condition that must be intentionally engineered, the need for local mount capability, and the absence of this code path on systems that never mount NTFS volumes. Pure server environments without NTFS exposure are not affected in practice.

The CVSS 7.8 score (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) is technically justified - a heap overflow in kernel context carries full C/I/A impact potential - but the local attack vector and specific triggering conditions substantially constrain real-world risk. EPSS at 0.18% (7th percentile) reflects the absence of any observed exploitation and the niche nature of the trigger: the attacker must control an NTFS volume with a specific page-size mismatch condition. No CISA KEV listing and no public POC further reduce urgency. The attack complexity is genuinely low once a suitable volume is crafted (AC:L is fair), but the prerequisite of local filesystem-mount capability rules out remote exploitation entirely. Even a mid-sized municipal IT team in bytom should treat this as a routine patch-cycle item rather than an emergency response, unless their environment includes shared workstations or kiosk systems where users routinely plug in external NTFS drives. Server environments that never mount NTFS volumes are essentially unexposed. The primary realistic threat is a malicious insider or a compromised user account on a desktop Linux system using ntfs3 to mount external media.

An attacker with a local shell on a Linux desktop or shared system crafts or obtains a dirty NTFS disk image whose $LogFile restart area records a 64K log page size - a condition achievable by formatting the volume on Windows with a large cluster size and then forcibly removing it without unmounting. The attacker mounts this image using the ntfs3 driver; during log replay, the kernel allocates a 4K scratch buffer but then adopts the 64K on-disk page size, subsequently writing 64K into the 4K heap allocation. The resulting heap overflow may be leveraged to overwrite adjacent kernel structures and escalate to root. No public POC has been identified at time of analysis.