What is the CVSS score of CVE-2026-72477?

CVE-2026-72477 has a contested CVSS base score of 9.8 from a third party (e.g. CISA-ADP), while the vendor rates it Critical. vuln.today uses the vendor rating as authoritative.

Which versions of Linux Kernel are affected by CVE-2026-72477?

The Linux kernel ntfs3 filesystem driver contains a critical error-handling vulnerability (CVE-2026-72477, CVSS 9.8) affecting systems that mount NTFS3 filesystems.

How to fix or mitigate CVE-2026-72477?

Within 24 hours, identify all production Linux systems using the ntfs3 filesystem driver and classify their operational criticality. Within 7 days, disable ntfs3 driver on non-critical systems or where the NTFS-3G userspace alternative is suitable, implement access controls restricting filesystem mount and administration operations to privileged users, and configure monitoring for kernel filesystem corruption events. Within 30 days, establish vendor patch readiness with your Linux distribution maintainer, conduct kernel update testing on a representative system subset, and schedule production deployment during established maintenance windows.

Linux Kernel CVE-2026-72477

EUVD-2026-59376 CRITICAL

2026-08-15 Linux

GHSA-9679-5mjr-46x9

Information Disclosure Linux Red Hat Suse

Critical

Disputed · 9.8 Vendor: Linux

Severity by source

Sources disagree (Medium–Critical)

Vendor (Linux) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

3.6 LOW

Requires local access to a mounted NTFS volume and a hard-to-force rename failure, so AV:L/AC:H/PR:L; impact is limited inode inconsistency, not disclosure or RCE, so C:N/I:L/A:L.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L

4.0 AV:L/AC:H/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

SUSE

5.5 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Red Hat

5.5 MEDIUM

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Linux

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 17, 2026 - 09:43 vuln.today

CVSS changed

Aug 17, 2026 - 06:22 NVD

9.8 (CRITICAL)

CVE Published

Aug 15, 2026 - 05:57 cve.org

CRITICAL 9.8

CVE Published

Aug 15, 2026 - 05:57 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

fs/ntfs3: call _ntfs_bad_inode() when failing to rename

It is safe to call _ntfs_bad_inode on live inodes since: commit 519b078998ce ("fs/ntfs3: Exclude call make_bad_inode for live nodes.")

The WARN_ON was added when it wasn't safe by: commit d99208b91933 ("fs/ntfs3: cancle set bad inode after removing name fails")

Replace the WARN_ON with a call to _ntfs_bad_inode() to prevent further operations on the inconsistent inode.

AnalysisAI

Improper error handling in the Linux kernel's ntfs3 filesystem driver leaves an inode in an inconsistent state after a failed rename, where a WARN_ON was previously hit instead of properly marking the inode bad. The fix replaces that WARN_ON with a _ntfs_bad_inode() call so the kernel stops operating on the corrupted inode. The recorded CVSS of 9.8 (AV:N/AC:L/PR:N/UI:N) is inconsistent with the actual change, which is a local filesystem-driver robustness fix; EPSS is 0.20% (10th percentile) and there is no public exploit identified at time of analysis and no CISA KEV listing.

Technical ContextAI

The affected component is fs/ntfs3, the in-tree Linux kernel read/write driver for Microsoft's NTFS filesystem introduced in kernel 5.15. The issue is in the rename path (ntfs_rename): when removing a directory-entry name fails, the code previously triggered a WARN_ON. That WARN_ON was added by commit d99208b91933 at a time when calling make_bad_inode on live inodes was unsafe, but commit 519b078998ce ('Exclude call make_bad_inode for live nodes') later made _ntfs_bad_inode() safe to call on live inodes. The bug class is improper handling of exceptional/error conditions (CWE-755-style) leading to continued use of an inode left in an inconsistent on-memory state; NVD lists no CWE. No CWE is provided in the input, so the root-cause class is inferred from the patch description rather than confirmed.

RemediationAI

Apply the upstream kernel fix by updating to a stable/distribution kernel that includes commits ff825bf0521f6da2f30878cbad18ab7b341bc31b or e8ed78f40eecd0176fda71d673f6957c98e7ffbe (Upstream fix available as stable commits; a single tagged mainline release version is not independently confirmed here) - in practice, take the latest patched kernel from your distribution vendor. As a compensating control until patched, avoid mounting untrusted or attacker-supplied NTFS images and restrict who can mount filesystems (e.g., do not grant unprivileged users mount capability and disable automount of removable NTFS media); the trade-off is reduced convenience for legitimate NTFS use. If ntfs3 is not needed, blacklisting/unloading the ntfs3 module removes the attack surface entirely at the cost of losing NTFS read/write support. Reference the NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-72477) and the kernel.org stable commits for authoritative fix tracking.

Same technique Information Disclosure

View all

CVE-2019-2725 CRITICAL POC

9.8

CVE-2021-34523 CRITICAL POC

9.0

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

CVE-2014-6324 HIGH POC

8.8

Vendor StatusVendor

SUSE

Severity: Important

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 16.0	Not-Affected

CVE-2026-72477 vulnerability details – vuln.today

Back

Linux Kernel CVE-2026-72477

Severity by source

CVSS VectorVendor: Linux

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

Same technique Information Disclosure

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code