Linux Kernel EUVD-2026-86972

Requires local access to a system where an NTFS volume is mounted read-write via the in-kernel ntfs3 driver, plus sufficient privilege to create files on that mount (consistent with PR:L). The flaw manifests only when set_reparse_index() actually fails during symlink(2) or WSL special-file creation (including the oldsize==0 no-prior-reparse-data case); under normal successful insertions it never triggers. Limiting factors: no remote vector (AV:L), the ntfs3 write path must be in active use (NTFS mounts are uncommon on Linux servers), and the underlying index-insertion failure condition must occur - which is not attacker-guaranteed from the available description. The trigger of the insertion failure itself is not detailed in the available sources.

All signals point to a low real-world priority despite the NVD base score of 5.5 (MEDIUM). The CVSS vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H requires local access and some privilege (PR:L) - specifically the ability to write to an NTFS volume mounted read-write via the in-kernel ntfs3 driver - and yields no confidentiality or integrity loss per NVD, only availability (A:H). EPSS is very low at 0.14% (3rd percentile), there is no CISA KEV listing (not actively exploited), and no exploit or PoC reference appears anywhere in the input, giving 'no public exploit identified at time of analysis.' The vuln.today decision label is 'this_month', i.e. routine patch cadence rather than act_now/emergency. Two signals conflict and should be noted: (1) the 'Information Disclosure' tag contradicts the CVSS C:N value and the description, which is a CWE-252 unchecked-return bug causing symlink(2)/WSL special-file creation to falsely report success while no reparse data is written to disk - this is a data-correctness/integrity problem, not disclosure; (2) the A:H rating looks generous for a bug whose observable effect is a silently-missing reparse record, so treat the 'HIGH availability impact' framing with caution. Net: a real correctness fix worth applying on normal schedule, not an urgent security emergency.

A local user with write access to an NTFS filesystem mounted read-write through the Linux ntfs3 driver creates a symlink or WSL special file; if the reparse index insertion in set_reparse_index() fails (e.g. under an underlying index/storage error), update_reparse_data() still returns 0, so the syscall reports success even though no reparse data exists on disk. The result is a silently inconsistent filesystem where the created symlink/special file is broken. No public exploit or PoC reference is present in the input.