Skip to main content

Linux Kernel EUVDEUVD-2026-59370

| CVE-2026-72471 HIGH
2026-08-15 Linux GHSA-w848-j2vg-qxfr
Information Disclosure Linux Red Hat Suse
7.1
CVSS 3.1 · Vendor: Linux
Share

Severity by source

Vendor (Linux) PRIMARY
7.1 HIGH
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
vuln.today AI
6.1 MEDIUM

Local filesystem driver requires low-privilege local access (AV:L/PR:L); information disclosure only with no integrity impact; minor availability risk from potential crash.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L
4.0 AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N
SUSE
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Red Hat
5.5 MEDIUM
qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
Low
Availability
None

Lifecycle Timeline

5
Analysis Generated
Aug 17, 2026 - 09:41 vuln.today
CVSS changed
Aug 17, 2026 - 06:22 NVD
7.1 (HIGH)
Patch available
Aug 15, 2026 - 07:20 EUVD
CVE Published
Aug 15, 2026 - 05:57 cve.org
HIGH 7.1
CVE Published
Aug 15, 2026 - 05:57 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

fs/ntfs3: prevent potential lcn remains uninitialized

The target VCN being sought was not found within runs[0], causing run_lookup() to return false. This causes run_lookup_entry() to return false, which in turn results in a len value of 0, and the new parameter passed to attr_data_get_block() is NULL. Collectively, these factors ultimately cause attr_data_get_block_locked() to exit prematurely without initializing lcn, thereby triggering [1].

To prevent [1], the clen check within ni_seek_data_or_hole() has been moved to occur before the lcn check.

[1] BUG: KMSAN: uninit-value in ni_seek_data_or_hole+0x24f/0x5f0 fs/ntfs3/frecord.c:2862 ni_seek_data_or_hole+0x24f/0x5f0 fs/ntfs3/frecord.c:2862 ntfs_llseek+0x22a/0x4a0 fs/ntfs3/file.c:1530 vfs_llseek fs/read_write.c:391 [inline]

AnalysisAI

Uninitialized kernel memory read in the Linux kernel's NTFS3 filesystem driver (fs/ntfs3) allows a low-privileged local user to potentially leak sensitive kernel memory contents via a crafted or specially structured NTFS file. The flaw manifests in ni_seek_data_or_hole() when run_lookup() fails to locate the target VCN in runs[0], causing attr_data_get_block_locked() to exit prematurely without initializing the lcn variable - a KMSAN-confirmed uninit-value read triggered through the ntfs_llseek/vfs_llseek call chain. No public exploit exists at time of analysis (EPSS 0.20%, 10th percentile) and this is not listed in CISA KEV, indicating low active exploitation risk despite the CVSS 7.1 base score.

Technical ContextAI

The vulnerability resides in the Linux kernel's NTFS3 driver at fs/ntfs3/frecord.c:2862, within ni_seek_data_or_hole(). NTFS3 is the modern in-tree read-write NTFS driver introduced in Linux 5.15 as a replacement for the legacy ntfs module. The root cause is a use-before-initialization of the lcn (Logical Cluster Number) variable - analogous to CWE-457 (Use of Uninitialized Variable) - triggered when run_lookup() returns false because the target VCN is absent from the run list (runs[0]). This propagates: run_lookup_entry() returns false → len is set to 0 and the new parameter passed to attr_data_get_block() is NULL → attr_data_get_block_locked() exits early leaving lcn unset. The Kernel Memory Sanitizer (KMSAN) detected the subsequent use of this uninitialized lcn value at line 2862. The fix reorders the clen check to precede the lcn check, ensuring safe early exit when the run-list lookup fails. The CPE cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:* covers the affected kernel versions starting from commit c61326967728392931f8a2240cb2cf4c81b523c1.

RemediationAI

Upgrade to Linux kernel 7.1.5 (stable) or 7.2-rc1 (mainline) or later, which include the verified fix commits 7ae7e98b71438c494532492cbf58fc0d7f7988bb (stable) and 57ac2831c8e0f168090d38e3de758c6a59db44db (mainline) from the upstream kernel stable tree at https://git.kernel.org/stable/c/7ae7e98b71438c494532492cbf58fc0d7f7988bb. For systems where immediate kernel upgrade is not feasible, avoid mounting NTFS3 filesystems on multi-tenant or sensitive systems - switching to the legacy ntfs driver (mount with type ntfs instead of ntfs3) eliminates the vulnerable code path, though at the cost of reduced write support and modern NTFS feature compatibility. On containerized or multi-tenant Linux environments, restrict NTFS3 mount capabilities via Linux namespace policies or seccomp-based syscall filtering to block unprivileged lseek() exploitation against NTFS3-mounted volumes. Patch urgency is moderate given low EPSS and absence from CISA KEV.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 16.0 Not-Affected

Share

EUVD-2026-59370 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy