External risk intelligence

Linux kernel NTFS3 inode corruption vulnerability.

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-72477

This vulnerability exists within the Linux kernel NTFS3 file system driver. File system drivers are local, low-level components that require physical or logical access to mount a storage medium; they are not exposed to the public internet or reachable via network services.

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A recent vulnerability has been identified in the Linux kernel's NTFS3 file system driver that could lead to system instability if an inconsistent inode is encountered during a rename operation. This issue has been resolved in updated kernel versions.

A file system driver issue could cause system instability.
Confirms the Linux kernel's integrity and proper function.
Ensure Linux systems are running updated kernel software.

Attack Path

How an attacker could exploit the issue

An attacker could trigger this vulnerability by performing a file system operation on a compromised or accessible Linux system that involves renaming files within the NTFS3 file system. This operation, when encountering a specific error condition during the renaming process, could lead to an inconsistent inode state. When this inconsistent inode is later accessed, it can result in system instability or denial of service.

Requires access to the Linux kernel.
Triggered by file rename operations.
Leads to system instability or denial of service.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability in the Linux kernel's NTFS3 file system driver could allow an attacker to cause a system to crash. This would occur when the driver attempts to rename a file under specific error conditions that lead to an inconsistent inode state.

System stability.
File system operations may fail.
Denial of service.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in the Linux kernel's NTFS3 driver requires identifying systems running the affected kernel version and then assessing their exposure. Infrastructure or platform teams are likely responsible for the kernel, while security and application owners should confirm the criticality and reachability of affected systems. The first practical step is to inventory systems, verify the presence of the NTFS3 driver, and determine its operational importance before planning remediation.

Kernel and Infrastructure teams should own the issue.
Verify NTFS3 driver presence and system criticality.
Plan remediation based on risk and operational impact.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Linux kernel NTFS3 driver?

The NTFS3 driver is a component within the Linux kernel that enables the operating system to read and write data to storage devices formatted with the NTFS file system. It is commonly used when Linux systems need to interact with external drives or partitions originally created for Windows environments.

What does CVE-2026-72477 mean for system stability?

This vulnerability involves an error-handling flaw that occurs during file renaming. When a rename operation fails under specific conditions, the system may be left with an inconsistent inode—a data structure that tracks file information. Rather than safely marking this inode as bad, the previous code triggered a warning, potentially allowing further operations on corrupted data that can lead to system crashes or denial of service.

How is this inode corruption triggered?

The vulnerability is triggered when a file rename operation encounters a specific failure within the NTFS3 driver. It requires an attacker to interact directly with the file system. Simply browsing files or having the NTFS3 driver loaded in the kernel does not trigger the bug; it specifically requires an active, failed attempt to rename a file or directory on an NTFS3-formatted volume.

Is my system at risk from the internet?

According to Halo Surface Signal, this vulnerability is very unlikely to be reachable from the internet. Because the NTFS3 driver is a low-level component that manages local storage, an attacker generally requires physical or logical access to mount a storage medium to the system before they can even attempt to trigger the file system operations needed to exploit this flaw.

What should I do if I run Linux with NTFS3?

Your first step is to inventory your environment to identify which systems are running a Linux kernel version that includes the NTFS3 driver. Once identified, confirm if those systems utilize NTFS-formatted storage. If they do, coordinate with your infrastructure or platform teams to prioritize applying the latest kernel updates provided by your distribution, which include the fix to safely handle these inode errors.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.