External risk intelligence

Linux Kernel NTFS3 Out-of-Bounds Write in Index Insertion.

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-72192

The vulnerability exists within the Linux kernel NTFS3 filesystem driver. Exploitation requires mounting a specially crafted, malicious filesystem image. This is a local-only operation that cannot be reached or triggered over a network, making it inaccessible in standard public-facing or remote deployment scenarios.

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability in the Linux kernel's NTFS3 driver could allow an attacker to write data beyond allocated memory, potentially leading to system instability or other impacts. This issue arises when processing a crafted NTFS image, and its exploitation requires local access to mount the malicious image. The main concern is confirming relevance and exposure within your environment.

Flaw in Linux kernel's file system driver.
Requires local access to a crafted file system.
Confirm relevance and exposure to any custom use.

Attack Path

How an attacker could exploit the issue

An attacker could trigger this vulnerability by creating a specially crafted NTFS filesystem image. Once this malicious image is mounted on a Linux system, a specific file creation operation within a full directory forces the kernel to copy data beyond the intended buffer. This leads to an out-of-bounds write within the kernel's memory, potentially allowing an attacker to corrupt adjacent data structures.

Requires mounting a crafted NTFS image.
Triggered by creating a file in a full directory.
Risk of controlled adjacent heap corruption.

Live Threat

Current exploitation, exposure, and threat context

A crafted NTFS image, when mounted, could allow an unprivileged user to trigger a controlled out-of-bounds write within the Linux kernel's NTFS3 driver. This corruption of adjacent heap memory could potentially affect system stability when specific conditions are met, such as a full resident root directory combined with a reduced index block size.

Kernel memory corruption.
Crafted NTFS image mounting.
System instability or crash.

Operational Fix

Recommended remediation, mitigation, and detection steps

This Linux kernel vulnerability, residing within the NTFS3 filesystem driver, presents a critical risk due to its potential for controlled out-of-bounds writes. Due to the requirement of mounting a specially crafted NTFS image, exploitation is a local-only operation. Identifying systems with this driver active, assessing their exposure to untrusted filesystems, and verifying the accountability for filesystem integrity are the immediate first steps.

Kernel maintainers own the fix.
Confirm mounted NTFS filesystem exposure.
Plan for filesystem integrity checks.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Linux kernel NTFS3 driver and how is it used?

The NTFS3 driver is a component within the Linux kernel that allows the operating system to read and write files on storage drives formatted with the Windows NTFS file system. It is commonly used when Linux systems need to interface with external disks, USB drives, or virtual machine images that originated in a Windows environment.

What does the CVE-2026-72192 vulnerability mean?

This is an out-of-bounds write vulnerability. It occurs because the software fails to properly check if incoming data fits into the memory buffer allocated for file index operations. If the data is larger than the space provided, the system writes that extra data into adjacent memory areas, which can corrupt nearby kernel structures.

How can an attacker trigger CVE-2026-72192?

An attacker must provide a specially crafted NTFS image to the system. When a user or system process mounts this malicious image and performs a file creation operation in a directory that is already full, the driver triggers the flawed memory copy. Simply viewing or storing the file does not trigger the bug; the filesystem must be actively mounted and used.

Is my system at risk according to Halo Surface Signal?

Halo Surface Signal indicates that this vulnerability is very unlikely to be remotely triggered. Because it requires mounting a specific malicious filesystem, it is a local-only operation. It is not reachable over a network, so systems that do not mount untrusted or arbitrary external storage are generally not at risk of remote exploitation.

What are the first steps for someone using this technology?

Start by identifying which Linux systems in your environment have the NTFS3 driver enabled or in use. Assess your exposure to untrusted or external filesystem images. The most practical response is to ensure your kernel is updated as patches become available from your distribution maintainers and to avoid mounting storage media from unknown or untrusted sources.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.