CVE-2026-72185 in Linux
Summary
by MITRE • 08/15/2026
In the Linux kernel, the following vulnerability has been resolved:
ntfs: fix WARN_ON for resident attribute in ntfs_map_runlist_nolock()
When ntfs_map_runlist_nolock() needs to look up the attribute extent containing a target VCN (ctx_needs_reset == true), it calls ntfs_attr_lookup() and then expects the result to be a non-resident attribute, since only non-resident attributes have a mapping pairs array to decompress.
A crafted NTFS image can place a resident attribute where a non-resident one is expected, causing ntfs_attr_lookup() to succeed but return a resident attribute record. Previously this was caught only by a WARN_ON(), which does not stop execution. The code then falls through to read a->data.non_resident.highest_vcn from what is actually a resident attribute, accessing the wrong union member and corrupting the VCN range check.
The caller path triggering this warning during mount is:
ntfs_map_runlist_nolock ntfs_empty_logfile load_system_files ntfs_fill_super
In this path ctx is NULL, so ntfs_map_runlist_nolock() allocates a temporary search context internally and sets ctx_needs_reset = true. The existing resident-attribute guard in the ctx != NULL branch already returns -EIO silently for the same condition; make the ctx_needs_reset path consistent by replacing the WARN_ON() with the same -EIO error return.
This causes the crafted image to be rejected with a mount error instead of triggering a kernel warning.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/15/2026
The vulnerability described represents a critical flaw in the Linux NTFS filesystem driver that arises from improper handling of attribute types during runlist mapping operations. This issue occurs within the ntfs_map_runlist_nolock() function which is responsible for managing the mapping between virtual cluster numbers and physical storage locations in NTFS filesystems. The flaw stems from an assumption that certain attributes must be non-resident, a condition that can be violated through carefully crafted filesystem images.
The technical implementation of this vulnerability involves a specific code path where ntfs_map_runlist_nolock() encounters a scenario requiring attribute extent lookup when ctx_needs_reset is true. Under normal circumstances, the function expects to work with non-resident attributes that contain mapping pairs arrays necessary for decompression operations. However, maliciously constructed NTFS images can place resident attributes in locations where non-resident ones are anticipated, causing ntfs_attr_lookup() to successfully return a resident attribute record instead of the expected non-resident one.
This mismatch creates a dangerous condition where subsequent code attempts to access fields within a union structure that does not correspond to the actual attribute type. Specifically, the code tries to read from a->data.non_resident.highest_vcn when working with what is actually a resident attribute, resulting in memory corruption during VCN range validation checks. The vulnerability manifests as a kernel warning rather than a complete system crash, but this allows malicious filesystem images to bypass detection mechanisms that would otherwise prevent mounting.
The operational impact of this vulnerability extends beyond simple kernel warnings to potentially enable privilege escalation or denial-of-service conditions through carefully crafted filesystem images. Attackers could exploit this by creating NTFS filesystems with malformed attribute structures that trigger the warning condition during mount operations, effectively allowing them to inject malicious data into kernel memory spaces. This represents a classic case of improper input validation where the system assumes specific data structures without verifying their actual type.
The vulnerability affects the ntfs_fill_super() function which is part of the filesystem mounting process, specifically when loading system files and handling empty logfiles. During these operations, when ctx is NULL, the function allocates temporary search contexts internally and sets ctx_needs_reset = true, creating the exact conditions where the vulnerability can be triggered. The existing defensive code in the ctx != NULL branch already handles this scenario appropriately by returning -EIO errors silently, but the ctx_needs_reset path lacked equivalent protection.
Security implications of this vulnerability align with CWE-129 Input Validation and CWE-787 Out-of-bounds Write categories, as the flaw involves improper validation of attribute types followed by incorrect memory access patterns. From an ATT&CK perspective, this maps to T1059 Command and Scripting Interpreter and T1499 Endpoint Denial of Service, as it could enable attackers to compromise system availability through filesystem mount operations. The fix implemented addresses the core issue by replacing the WARN_ON() macro with consistent -EIO error returns across both code paths, ensuring that malicious filesystem images are rejected during mounting rather than allowing kernel warnings to occur.
This vulnerability demonstrates the importance of defensive programming practices in kernel drivers, particularly regarding assumption validation and proper error handling. The fix ensures that all code paths maintain consistent behavior when encountering unexpected attribute types, preventing potential exploitation while maintaining system stability. The solution represents a standard approach for handling type confusion errors in kernel space code, where explicit error returns are preferred over silent failures that could mask underlying issues.