External risk intelligence

Linux Kernel NTFS B+ Tree Stack Overflow leading to System Panic

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-72194

The vulnerability requires mounting a malicious filesystem, typically via physical access or user-interactive media such as a USB drive. It is not exposed to the public internet in common deployments.

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability in the Linux kernel's NTFS file system driver could allow an attacker to crash systems by mounting a specially crafted NTFS file system. This could be triggered by actions like deleting a file from a USB drive. While the Linux kernel is affected, the primary concern is confirming relevance and exposure due to the specific conditions required for exploitation.

Prevents system crashes from malicious file systems.
Critical for system stability and data integrity.
Confirm relevance and assess potential exposure.

Attack Path

How an attacker could exploit the issue

An attacker could trigger a system crash by mounting a specially crafted NTFS filesystem. When a user deletes a file from this malicious filesystem, the system attempts to rebalance its index, leading to uncontrolled recursion in the kernel. This deep recursion exhausts the kernel's stack memory, causing a system-wide panic.

Requires mounting malicious filesystem.
Triggered by file deletion operation.
Results in system crash.

Live Threat

Current exploitation, exposure, and threat context

A crafted NTFS filesystem could trigger a stack overflow in the Linux kernel, leading to a system crash. This is possible when mounting a malicious NTFS filesystem, for example, from a USB drive, and then deleting a file whose index entry causes a specific rebalancing operation.

Kernel stack overflow.
Mounting malicious NTFS filesystem.
System crash.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability impacts the Linux kernel's NTFS filesystem driver, specifically the `indx_find_buffer` function, which can lead to a stack overflow and system panic. Real-world responsibility likely falls to infrastructure or platform teams managing Linux systems, with potential involvement from security teams for initial triage and vendor management if specific hardware or distributions are affected. The first practical step is to identify all systems mounting NTFS filesystems, assess their exposure (e.g., use of removable media), confirm business criticality, and then plan remediation, which may involve kernel updates or other mitigations.

Linux infrastructure and platform teams own this.
Verify systems mounting NTFS and exposure.
Plan kernel updates or risk mitigation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Linux kernel NTFS driver and why does it matter?

The NTFS driver is a component of the Linux kernel that allows the operating system to read and write data on drives formatted with the Windows New Technology File System. It is frequently used to provide interoperability when connecting external storage, such as USB drives or shared disks, to Linux-based systems for file management.

What does CVE-2026-72194 mean for system stability?

This CVE involves a stack overflow vulnerability caused by uncontrolled recursion. When the kernel processes a corrupted NTFS index structure, it can enter a loop that exhausts memory reserved for kernel tasks. This weakness, which results in a system-wide panic, effectively stops the operating system from functioning until it is restarted.

How is this stack overflow triggered?

The issue occurs when a malicious NTFS filesystem is mounted and a specific file deletion is performed. This triggers a rebalancing process that enters a deep recursion loop. Importantly, simply mounting the filesystem is not enough; the crash is triggered by the subsequent attempt to modify index entries within that crafted environment.

Is my system at risk according to Halo Surface Signal?

Halo Surface Signal indicates that this threat is very unlikely in typical scenarios. Because the vulnerability requires mounting a specific malicious filesystem—often through physical access or user-interacted media like a USB drive—it is not exposed to the public internet in most common deployments. Focus on environments where untrusted external media is frequently attached.

What are the first steps to handle this kernel issue?

Begin by identifying which of your systems have the capability to mount NTFS filesystems, particularly those configured to automatically handle removable media. Assess whether these systems interact with untrusted external drives. If such use is necessary, prioritize applying kernel updates provided by your distribution vendor that introduce the required depth limits to index functions.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.