External risk intelligence

Linux Kernel NTFS Resident Attribute Corruption Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-72185

This vulnerability exists within the Linux kernel NTFS filesystem driver. Exploitation requires an attacker to provide a specially crafted filesystem image, which must then be mounted by the system. This process is inherently local or requires an authenticated user with high privileges to mount untrusted storage media, making public internet exposure of this attack surface extremely unlikely.

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory details a resolved vulnerability in the Linux kernel's NTFS file system driver that could allow a specially crafted NTFS image to cause a kernel warning or mount error. The issue arises when the driver incorrectly handles resident attributes, potentially leading to corrupted data range checks.

A flaw allows crafted filesystems to cause errors.
Matters for systems handling untrusted NTFS drives.
Verify if your systems mount external NTFS volumes.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by presenting a specially crafted NTFS filesystem image. If the system mounts this malicious image, the kernel's NTFS driver could be tricked into misinterpreting attribute data, leading to corrupted internal state and a potential crash or other severe system issues.

Requires attacker-controlled filesystem image.
Triggered when the system mounts the crafted image.
Can lead to critical system instability or failure.

Live Threat

Current exploitation, exposure, and threat context

When a specially crafted NTFS image is mounted, it could corrupt the virtual cluster number (VCN) range check, leading to unexpected behavior. This could occur when the system attempts to map attribute extents during the mounting process.

Kernel warning, potential data corruption.
Malicious NTFS image mounted.
System instability or data integrity issues.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability impacts the Linux kernel's NTFS driver, meaning system administrators or infrastructure teams responsible for managing Linux systems and their storage are the primary stakeholders. The first actionable step is to identify all Linux systems running the affected kernel, determine if they mount NTFS volumes, and assess the criticality of those mounts. This context is crucial for prioritizing remediation efforts and engaging the correct technical owners.

Identify systems mounting NTFS.
Verify if NTFS mounts are critical.
Plan remediation based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Linux kernel NTFS driver and why is it used?

The Linux kernel NTFS driver is a component that enables the operating system to read and write data on storage devices formatted with the Windows New Technology File System (NTFS). It is commonly used when Linux systems need to interface with external hard drives, USB flash drives, or multi-boot partitions originally created for or shared with Windows environments.

What is the nature of the flaw in CVE-2026-72185?

This vulnerability involves an improper input validation weakness. When processing an NTFS image, the driver expects a non-resident attribute but receives a resident one instead. Because the code failed to stop execution when this mismatch occurred, it attempted to read data from the wrong location in memory, which could cause internal data corruption or system instability.

How is this vulnerability triggered?

The issue is triggered only when the kernel mounts a specially crafted NTFS filesystem image. It does not occur during normal system operation with standard or valid drives. If the NTFS image is well-formed or if the drive is not mounted by the kernel, the specific path that causes this corruption remains inactive.

Is my system at risk if I use NTFS volumes?

According to Halo Surface Signal, this vulnerability is very unlikely to be exposed via the internet. Because the attack requires a specially crafted filesystem image to be physically or logically mounted, the risk is largely confined to systems where users or processes have the authority to connect and mount untrusted or external storage media.

How should I respond to this Linux kernel issue?

You should start by creating an inventory of your Linux systems to determine which ones are configured to mount NTFS volumes. Once identified, evaluate whether those mounts are necessary or if they involve untrusted media. Prioritize applying the relevant kernel updates provided by your distribution vendor to ensure the driver correctly handles malformed filesystem records.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.