CVE-2026-72186 in Linux
Summary
by MITRE • 08/15/2026
In the Linux kernel, the following vulnerability has been resolved:
ntfs: make system files immutable to prevent corruption
When a system file such as $Bitmap is exposed via show_sys_files and written from userspace, the volume is corrupted and, because the cluster allocator scans $Bitmap through the same inode's page cache, a write to $Bitmap also deadlocks writeback against the folio it already holds locked.
These files are maintained by the driver itself and have no valid reason to be written through the file interface. Mark base metadata files (mft_no < FILE_first_user) as immutable during inode read so the VFS rejects write, mmap, truncate and unlink with -EPERM. Directories are skipped so the root and $Extend remain usable. Internal metadata updates do not go through the VFS write path and are unaffected.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/15/2026
This vulnerability exists within the ntfs filesystem driver of the Linux kernel where system files such as $Bitmap become accessible through the show_sys_files interface, creating a critical pathway for volume corruption. The flaw stems from the inability to properly protect core metadata files that are essential for filesystem integrity. When userspace applications attempt to write to these protected system files through the standard file interface, the filesystem experiences immediate corruption due to the fundamental nature of how cluster allocation works within NTFS volumes.
The technical implementation of this vulnerability occurs through the interaction between the cluster allocator and the $Bitmap file itself. When a write operation targets $Bitmap, the cluster allocator must scan through the same inode's page cache, creating a deadlock scenario where writeback operations become blocked against folios already held in a locked state. This creates a circular dependency that prevents normal filesystem operations from completing properly and results in complete volume corruption. The vulnerability specifically affects base metadata files identified by mft_no < FILE_first_user where the Master File Table number indicates core system files rather than user data.
The operational impact of this vulnerability extends beyond simple data corruption to include complete system instability when dealing with NTFS volumes. Attackers or malicious processes that can access the show_sys_files interface gain the ability to corrupt critical filesystem metadata, potentially rendering entire volumes inaccessible. The deadlock condition created during write operations means that normal filesystem operations cannot proceed, leading to system hangs and requiring manual intervention to recover. This vulnerability represents a serious threat to systems that rely on NTFS filesystems for data storage, particularly in enterprise environments where filesystem stability is paramount.
The mitigation strategy involves marking base metadata files as immutable during inode read operations, which prevents the VFS layer from accepting write, mmap, truncate, and unlink operations with -EPERM errors. This approach follows established security principles by ensuring that internal metadata files cannot be modified through standard file access interfaces while preserving functionality for legitimate system operations. The solution specifically skips directory handling to maintain usability of root directories and $Extend folders, ensuring that normal filesystem operations continue to function properly. Internal metadata updates continue to bypass the VFS write path entirely, maintaining the integrity of core filesystem mechanisms while preventing user-space interference with critical system files.
This vulnerability aligns with CWE-276: Incorrect Permission Assignment for Critical Resources, where insufficient access controls allow unauthorized modification of system-critical components. The implementation follows ATT&CK technique T1566.001: Phishing: Spearphishing Attachment, where attackers could potentially exploit this weakness through malicious file operations targeting system metadata. The fix demonstrates proper defensive programming practices by implementing mandatory access controls at the inode level rather than relying on runtime checks that could be bypassed.
The vulnerability represents a classic case of insufficient input validation and access control enforcement within filesystem drivers. By establishing immutable attributes for core metadata files during inode initialization, the kernel prevents any possibility of user-space processes from corrupting critical system data through standard file operations. This approach follows the principle of least privilege by ensuring that only the filesystem driver itself can modify these critical files through its internal update mechanisms, while all external access attempts are properly rejected with appropriate error codes.
The implementation provides comprehensive protection against this specific corruption scenario while maintaining functional integrity of the overall filesystem. The solution effectively addresses both the immediate deadlock condition and the broader security implications of allowing user-space modification of system-critical metadata files. Through immutable marking during inode read, the filesystem driver creates a robust barrier that prevents any write operations to core metadata files through standard interfaces, thus eliminating the possibility of corruption while preserving all legitimate filesystem functionality for normal operations.