CVE-2026-72188 in Linux
Summary
by MITRE • 08/15/2026
In the Linux kernel, the following vulnerability has been resolved:
ntfs: sanitize MFT references returned from ntfs_lookup_inode_by_name()
ntfs_lookup_inode_by_name() returns MFT references read from directory index entries on disk. These values are untrusted, but the function can currently return an error-marked MFT reference to its callers without validating it.
Callers later decode lookup failures with MREF_ERR(). A crafted NTFS image can set the MREF error bit while leaving the low bits as an arbitrary value, causing callers to consume a bogus pseudo-errno instead of treating the lookup result as corrupted on-disk metadata.
Fix this at the source by normalizing every error-marked MFT reference returned from ntfs_lookup_inode_by_name() to ERR_MREF(-EIO). Apply this to all four directory lookup return paths so every caller gets a validated result without needing additional checks or an API change.
This keeps the sanitization in the common lookup helper, which is cleaner than duplicating validation in each caller.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/15/2026
The vulnerability identified in the Linux kernel's NTFS implementation stems from inadequate validation of MFT (Master File Table) references returned by the ntfs_lookup_inode_by_name() function. This function serves as a critical component in the NTFS filesystem driver, responsible for locating inodes based on directory entries stored on disk. The flaw arises because the function processes MFT references directly from on-disk directory index entries without proper sanitization of error-marked references. According to CWE-248, this represents an improper handling of exceptional conditions where untrusted data from external sources is not adequately validated before being passed to downstream consumers.
The technical implementation flaw occurs when ntfs_lookup_inode_by_name() encounters corrupted or maliciously crafted NTFS images. The function can return MFT references that have the error bit set (MREF_ERR()) while maintaining arbitrary values in the lower bits of the reference. This creates a dangerous scenario where callers interpret these malformed references as pseudo-errno values rather than recognizing them as corrupted metadata. The vulnerability demonstrates poor input validation practices and represents a classic case of insufficient data sanitization, which aligns with ATT&CK technique T1210 for exploitation of vulnerabilities in operating systems.
The operational impact of this vulnerability extends beyond simple filesystem corruption, potentially enabling privilege escalation or denial-of-service conditions in systems running NTFS filesystems. When maliciously crafted NTFS images are mounted, the improper error handling can cause kernel memory corruption or unexpected behavior in applications relying on proper filesystem metadata validation. The fix implemented addresses this by normalizing all error-marked MFT references to ERR_MREF(-EIO) within the ntfs_lookup_inode_by_name() function itself, ensuring that all four directory lookup return paths consistently provide validated results.
This mitigation strategy follows security best practices by implementing defense-in-depth principles and avoiding the duplication of validation logic across multiple caller functions. The solution maintains API compatibility while providing robust sanitization at the source level, which is more maintainable and less error-prone than requiring each caller to implement its own validation checks. The approach also aligns with the principle of least privilege by ensuring that corrupted data cannot propagate through the system in an uncontrolled manner. By centralizing the sanitization within the common lookup helper, the fix reduces the attack surface and ensures consistent behavior across all filesystem operations that depend on this function, ultimately strengthening the overall security posture of Linux systems using NTFS filesystems.