Linux Kernel CVE-2026-74570

Exploitation requires the vulnerable NTFS driver to actually parse attacker-controlled data - concretely, a crafted NTFS volume or disk image must be mounted or otherwise processed by ntfs_rl_realloc()/ntfs_rl_realloc_nofail(). This means the ntfs kernel module must be present and loaded, and there must be a mechanism to feed the malicious image to it (physical/USB access with automounting enabled, an untrusted image-processing pipeline, or a user manually mounting the volume). Limiting factors: it does not apply to systems that never mount NTFS or have the module blacklisted; despite the published AV:N/PR:N vector, there is no evidence of a genuine remote network path, so the practical prerequisite is local access or user-driven mounting rather than unauthenticated remote reachability.

The headline signals conflict sharply. The published CVSS is 9.8 with vector AV:N/AC:L/PR:N/UI:N, implying remote unauthenticated exploitation - but the vulnerability lives in the NTFS filesystem parser, which is only reached by mounting or parsing an NTFS image, a fundamentally local/physical or user-interaction-driven surface. This is a well-known pattern of over-scored Linux kernel filesystem CVEs, and the AV:N here should be treated as suspect and verified against the actual code path rather than accepted as fact. Supporting this, EPSS is very low (0.14%, 4th percentile), the CVE is not on CISA KEV, and no public proof-of-concept is referenced. Realistically this is a serious memory-safety bug worth patching in the normal kernel update cadence, but it is not an internet-facing, mass-exploitable emergency; the most credible threat models are malicious removable media, attacker-supplied disk images in forensic/analysis pipelines, or automounting of untrusted volumes. Any operator whose systems automount untrusted NTFS media should prioritize the patch, while purely server fleets that never touch NTFS carry near-zero exposure.

An attacker crafts a malicious NTFS filesystem image with runlist metadata engineered to trigger the integer overflow, then gets a target host to mount it - for example by inserting a USB drive into an unlocked workstation that automounts removable media, or by submitting the image to an automated analysis/forensics service. When the kernel parses the runlist and reallocates the undersized buffer, the resulting heap overflow corrupts kernel memory, which a skilled attacker may leverage toward privilege escalation. No public exploit code is currently identified.