External risk intelligence

Linux Kernel NTFS Metadata Validation Flaw

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2026-72188

This vulnerability exists within the Linux kernel NTFS filesystem driver, which requires a user to mount a crafted, malicious filesystem image. It is not a network-reachable service or internet-facing interface, as it requires physical or local access to provide the malicious storage media.

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability in the Linux kernel's NTFS file system driver could allow an attacker to manipulate how file lookups fail, potentially leading to system instability or data corruption if a specially crafted NTFS disk image is mounted. The issue lies in how the driver handles error references, which are not being properly validated before being returned to calling functions.

Malicious disk images could trick file lookups into failing incorrectly.
Consider if your systems mount untrusted NTFS disk images.
Focus on confirming exposure to this specific filesystem risk.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by providing a specially crafted NTFS disk image. When the Linux kernel attempts to read information from this image, a flaw in how it handles certain file references can be triggered. This could lead to unexpected behavior, potentially allowing the attacker to manipulate file system operations.

Requires crafted NTFS image.
Vulnerability in file reference handling.
Risk of file system corruption.

Live Threat

Current exploitation, exposure, and threat context

When a crafted NTFS image is mounted, the Linux kernel's NTFS driver could misinterpret directory entries, potentially leading to system instability or unexpected behavior. This happens when the driver reads untrusted MFT references from disk and fails to properly validate them, causing callers to process corrupted metadata.

Corrupted filesystem metadata at risk.
Mounting a malicious NTFS image.
System instability or unexpected behavior.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Linux kernel's NTFS driver is vulnerable when processing specially crafted NTFS images. Identifying systems using the NTFS driver and confirming exposure to untrusted storage media is the critical first step, followed by coordinated remediation efforts based on risk assessment and scheduled maintenance.

Linux kernel owners should address this.
Verify unpatched kernel instances.
Plan and execute remediation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Linux kernel NTFS driver used for?

The NTFS driver is a component of the Linux kernel that enables the operating system to read and write data to storage devices formatted with the Windows New Technology File System. It allows Linux systems to interact with hard drives, USB sticks, or disk images that are primarily used in Windows environments.

What does CVE-2026-72188 mean in simple terms?

This vulnerability is an input validation error. The driver fails to properly check file system references found on a disk before using them. By providing a specially crafted NTFS image, an attacker can supply malicious metadata that confuses the system, potentially leading to file system corruption or unexpected system behavior.

How is this Linux kernel vulnerability triggered?

The vulnerability is triggered only when the system mounts a specially crafted, malicious NTFS disk image. It does not trigger during standard file operations on trusted disks, nor does it occur simply by having the NTFS driver module loaded in the kernel without actively mounting a compromised filesystem.

Is my system at risk according to Halo Surface Signal?

Halo Surface Signal identifies this as a local access issue rather than an internet-facing threat. Because the vulnerability requires mounting a specific malicious storage medium, systems that do not interact with untrusted or externally sourced NTFS disks face a much lower risk compared to systems that regularly mount removable media.

What should I do if I run systems using NTFS?

First, identify all Linux instances that have the NTFS driver enabled and evaluate whether they are required to process untrusted storage media. Prioritize these systems for updates. Coordinate with your team to patch the kernel to a version that includes the validation fix for MFT references, and avoid mounting filesystems from unknown or untrusted sources.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.