External risk intelligence

Linux Kernel NTFS3 Out-of-Bounds Write Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-72191

This vulnerability resides in the Linux kernel's NTFS3 filesystem driver. Exploitation requires a user to mount a crafted, malicious filesystem image. This is a local-only attack vector requiring physical or logical access to mount storage media; it is not reachable via the public internet or standard network services.

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability has been resolved in the Linux kernel's NTFS3 filesystem driver that could allow for a denial-of-service by corrupting memory, leading to a system crash. This issue is triggered when a specially crafted NTFS filesystem image is mounted, which can be achieved through local access, such as via removable media. The main concern is confirming relevance and exposure to this specific driver.

A memory corruption issue was fixed in the kernel.
Local mounting of a malicious filesystem can trigger it.
Confirm if the NTFS3 driver is in use.

Attack Path

How an attacker could exploit the issue

An attacker could craft a malicious NTFS filesystem image that, when mounted on a Linux system, tricks the kernel's NTFS3 driver into miscalculating buffer sizes. This leads to an out-of-bounds write in the kernel, potentially corrupting memory and causing the system to crash. The attack requires local access to mount the crafted filesystem.

Requires local mount of crafted image.
Triggered by inserting a malformed entry.
Risk of kernel memory corruption and crash.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow a malicious actor to crash the Linux kernel when a specially crafted NTFS filesystem image is mounted. This could impact system stability and availability when local access to mount a filesystem is possible, such as with removable media.

Kernel integrity and availability.
Mounting a crafted filesystem image.
System instability and kernel panic.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Linux kernel's NTFS3 driver is affected by a vulnerability that could allow an attacker to cause a kernel panic and out-of-bounds write. This is a critical vulnerability that requires careful triage. The first practical step is to identify all systems that mount NTFS filesystems locally, confirm exposure through automated or manual mounts, and then assess the risk based on business criticality. Ownership for remediation likely falls to the Linux infrastructure or platform teams, in coordination with security and vendor management if commercial support is involved.

Linux infrastructure and platform teams should own the issue.
Verify local NTFS filesystem mount points and automated mounts.
Plan remediation based on risk and maintenance windows.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Linux kernel ntfs3 driver?

The ntfs3 driver is a component within the Linux kernel that allows the operating system to read and write data to NTFS-formatted storage devices. It is commonly used when connecting Windows-compatible drives, such as USB sticks or external hard drives, to a Linux system, ensuring the kernel can correctly interpret the file structure and manage data access on those volumes.

What does this CVE-2026-72191 vulnerability mean?

This is an out-of-bounds write vulnerability. It occurs because the driver fails to properly validate the size of entries within a filesystem image before processing them. When a maliciously crafted image is mounted, the driver can be tricked into calculating an incorrect buffer size, leading to memory corruption. This flaw can cause the kernel to overwrite adjacent memory, typically resulting in an immediate system crash.

How is this memory corruption triggered?

The issue is triggered when a user or automated system mounts a specially crafted NTFS filesystem image. The driver attempts to insert an entry into a buffer, but because the size field of the entry is not validated against the actual buffer limits, it causes a calculation error. Normal, non-malicious NTFS images do not trigger this bug; the filesystem must be intentionally prepared with incorrect size metadata to exploit the specific path in the memory management routine.

Is my system at risk according to Halo Surface Signal?

Halo Surface Signal indicates this is unlikely to be reachable via the public internet. Because the vulnerability requires an attacker to mount a physical or logical storage device to the system, it is a local-only attack vector. You are generally not at risk from remote network-based exploitation; the threat is primarily relevant if your systems frequently mount untrusted or unknown storage media.

What should I do if I run systems with NTFS support?

Start by identifying all infrastructure where the ntfs3 driver is active, particularly systems that automatically mount removable media. Review your environment for any processes that mount external NTFS drives. Once identified, prioritize these systems for kernel updates provided by your distribution vendor, as these updates contain the necessary validation checks to safely handle filesystem metadata.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.