External risk intelligence

Linux Kernel NTFS Mapping Pairs Overflow

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-72200

This vulnerability exists within the Linux kernel's NTFS filesystem driver, which handles local disk structures. Processing a filesystem typically requires local access or the mounting of a specific storage medium, making public-internet exposure of this code path extremely unlikely in standard deployments.

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This Linux kernel vulnerability in the NTFS file system driver could allow a specially crafted file to alter how data is read from storage. While the technical details involve integer overflows, the high-level implication is that unexpected data interpretations could occur if this specific code path is triggered. The main concern at this stage is confirming relevance and exposure within your environment.

NTFS driver can misinterpret data.
Understand potential data reading corruption.
Confirm if your systems use NTFS on Linux.

Attack Path

How an attacker could exploit the issue

An attacker could manipulate the NTFS file system's mapping-pairs parser by providing a specially crafted, corrupted attribute. This corruption could cause an integer overflow when calculating physical cluster addresses, potentially leading to the attacker's control over data processing.

Requires specially crafted NTFS attribute.
Integer overflow in LCN calculation.
Potential for unauthorized data manipulation.

Live Threat

Current exploitation, exposure, and threat context

A vulnerability in the Linux kernel's NTFS driver could allow an attacker to manipulate how the system interprets file cluster information when processing a specially crafted NTFS attribute. This manipulation could lead to unexpected behavior when the system attempts to read or write to the file system.

Filesystem integrity.
Corrupt attribute processing.
System instability or data corruption.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in the Linux kernel's NTFS driver could allow a specially crafted attribute to cause a signed integer overflow, potentially leading to unexpected physical cluster mappings. Real-world impact is likely limited to systems directly interacting with malformed NTFS file system structures. The first practical step is to identify any systems that mount or process NTFS volumes, determine their exposure and criticality, and then coordinate with the Linux kernel maintainers or distribution vendors for an update.

Linux kernel and distribution teams own the fix.
Verify systems processing NTFS volumes.
Plan for kernel updates and testing.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Linux kernel NTFS driver used for?

The NTFS driver is a component of the Linux kernel that enables the operating system to recognize, read, and write data to storage devices formatted with the Windows New Technology File System (NTFS). It allows Linux systems to interact with external drives, dual-boot partitions, or network-attached storage that utilize this common Windows filesystem structure.

How does CVE-2026-72200 cause an integer overflow?

This vulnerability involves a weakness in how the NTFS driver processes mapping-pairs, which describe where files are physically located on a disk. If an attacker provides a corrupted file attribute with specific values, the driver's math can exceed the maximum capacity of a signed integer. This overflow forces the system to miscalculate physical cluster addresses, leading to incorrect data interpretation.

Does just viewing a file trigger this NTFS bug?

No, simply browsing or viewing a file's metadata is typically not enough to trigger the issue. The vulnerability requires the system to actively parse a specifically crafted, corrupted NTFS attribute during filesystem operations. If the filesystem is not mounted or the specific malicious attribute is not processed by the kernel, this code path remains dormant.

How do I determine if my system is at risk?

Halo Surface Signal indicates that since this bug resides in the NTFS filesystem driver, it primarily affects systems that mount or process external storage media or NTFS-formatted volumes. You should identify if your Linux environment uses NTFS, particularly if it handles untrusted or external drives, as public-internet exposure of this driver is considered very unlikely.

What should I do to protect my systems?

Start by auditing your infrastructure to find systems that mount NTFS volumes. Once identified, monitor for security updates released by your Linux distribution provider or the kernel maintainers. Since the fix requires a code change to the driver, applying the official kernel patches provided by your vendor is the necessary step to resolve the underlying integer overflow.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.