External risk intelligence

Linux Kernel NTFS Off-by-One Bounds Check Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-72210

The vulnerability exists within the Linux kernel NTFS filesystem driver, which requires processing a specially crafted filesystem or file. This is a local, file-based operation rather than a service-based network interface, making it effectively inaccessible to remote network attackers in standard deployments.

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory addresses a vulnerability in the Linux kernel's NTFS filesystem driver that has been resolved. The issue involved an "off-by-one" error in how the system checked the boundaries of data related to file compression, potentially allowing for a read beyond the expected data limits.

Reading beyond data limits in file compression.
Potential for subtle data corruption or misinterpretation.
Confirm relevance and exposure to NTFS file handling.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by crafting a malicious NTFS filesystem or file. When the Linux kernel's NTFS driver processes this crafted data, a specific function that decodes mapping pairs can be tricked into reading one byte beyond the allocated attribute buffer. This out-of-bounds read can lead to a denial-of-service condition or potentially allow for code execution.

Requires processing crafted NTFS data.
Triggered by out-of-bounds read during data decoding.
Can lead to denial-of-service or code execution.

Live Threat

Current exploitation, exposure, and threat context

When processing NTFS file system data, a one-byte read beyond the end of attribute records could occur under specific conditions, potentially affecting the integrity and availability of system data.

Kernel memory could be exposed.
Malicious NTFS file processing.
System instability or crashes.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability affects the Linux kernel's NTFS driver, specifically an off-by-one error in bounds checking during data decompression. Real-world ownership would likely fall to the infrastructure or platform teams responsible for managing the Linux operating system and its components. The first practical step is to identify Linux systems utilizing the NTFS filesystem, assess their business criticality and exposure, and then coordinate remediation with the accountable system owners.

Linux infrastructure teams own this issue.
Verify NTFS usage and system criticality.
Plan and coordinate OS-level updates.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Linux kernel NTFS driver and why does it matter?

The NTFS driver is a core component of the Linux kernel that allows the operating system to read and write data on storage drives formatted with the Windows New Technology File System. It is used in environments where systems must mount, manage, or share storage devices between Linux and Windows platforms.

What is the nature of the vulnerability in CVE-2026-72210?

This is an out-of-bounds read vulnerability. It occurs when the kernel attempts to decompress file data and incorrectly calculates the memory boundaries of an attribute record. Because of a logic error known as an off-by-one, the system reads one byte past the intended buffer limit.

How can an attacker trigger this out-of-bounds read?

An attacker must supply a specifically crafted NTFS filesystem or file to the system. The flaw is not triggered by standard network requests; it only occurs when the kernel's NTFS driver actively processes the malformed data during file access or system operations.

Is this vulnerability reachable from the internet?

Halo Surface Signal indicates that this issue is very unlikely to be reachable via network services. Since the vulnerability requires the kernel to parse a physical or mounted filesystem, it is primarily a local risk rather than one typically exposed to remote network attackers in standard configurations.

What should I do if I manage Linux systems?

First, identify which of your servers or workstations are configured to mount or process NTFS volumes. Once identified, prioritize these systems for kernel updates provided by your distribution vendor, which will contain the corrected boundary checks for the NTFS driver.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.