CVE-2026-72198 in Linux
Summary
by MITRE • 08/15/2026
In the Linux kernel, the following vulnerability has been resolved:
ntfs: reject non-resident records for resident-only attributes
The shared lookup-time attribute validator rejects non-resident $FILE_NAME and $VOLUME_NAME records because their formats require resident values and callers handle returned records as resident attributes. Other resident-only attribute types still pass through the generic non-resident mapping-pairs checks.
That leaves real resident/non-resident union confusion paths. Inode load looks up $STANDARD_INFORMATION and then reads data.resident.value_offset without checking a->non_resident. ntfs_inode_sync_standard_information() does the same when updating the standard information value. ntfs_write_volume_flags() also looks up $VOLUME_INFORMATION and reads data.resident.value_offset directly. $INDEX_ROOT callers in dir.c and index.c depend on the same lookup contract before consuming the resident index root value.
Reject non-resident records for all resident-only attribute types in the shared validator. Keep the existing $FILE_NAME and $VOLUME_NAME behavior, but factor it through a helper and extend it to $STANDARD_INFORMATION, $OBJECT_ID, $VOLUME_INFORMATION, $INDEX_ROOT, and $EA_INFORMATION. For $OBJECT_ID and $EA_INFORMATION this is contract hardening for resident-only formats; this patch only rejects the non-resident form and does not add new resident value validation for those types.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/15/2026
This vulnerability exists within the ntfs filesystem driver of the Linux kernel where a critical inconsistency occurs in how resident-only attribute types are validated during lookup operations. The flaw stems from improper handling of attribute records that should exclusively be resident but can potentially contain non-resident data structures. When the shared lookup-time attribute validator processes certain attribute types, it fails to properly reject non-resident records for attributes that are defined as resident-only in the ntfs specification. This creates a dangerous condition where the kernel's filesystem code assumes all returned records for these specific attribute types are resident, while simultaneously allowing non-resident forms to pass through validation mechanisms that were designed for different attribute categories.
The technical implementation of this vulnerability manifests in multiple locations throughout the ntfs kernel module where attribute lookup operations occur without proper validation of the non-resident flag. During inode loading processes, the code performs lookups for $STANDARD_INFORMATION attributes and directly accesses data.resident.value_offset without first checking whether the attribute is actually resident or non-resident. Similar patterns appear in ntfs_inode_sync_standard_information() when updating standard information values, and in ntfs_write_volume_flags() when reading volume information records. The issue extends to directory operations through $INDEX_ROOT callers in dir.c and index.c where the same assumption about resident-only data structures is made before processing index root values. This fundamental misunderstanding of attribute format requirements creates a path where kernel memory can be accessed using incorrect offset calculations, potentially leading to memory corruption or information disclosure.
The operational impact of this vulnerability spans multiple security domains including privilege escalation, information disclosure, and system stability. Attackers could exploit this inconsistency by crafting malicious ntfs filesystem structures that contain non-resident forms of attributes meant to be resident-only. Such exploitation could lead to kernel memory corruption through improper offset calculations, potentially allowing for privilege escalation or denial of service conditions. The vulnerability affects any system running the Linux kernel with ntfs support and could impact systems where ntfs filesystems are mounted, particularly those with user-controllable storage media. This flaw represents a violation of the ntfs filesystem specification and creates an inconsistent state where the kernel's assumption about attribute formats does not match the actual data structure being processed.
The recommended mitigation strategy involves implementing comprehensive validation in the shared attribute validator to explicitly reject non-resident records for all resident-only attribute types while maintaining backward compatibility for the specific behavior of $FILE_NAME and $VOLUME_NAME attributes. The fix requires refactoring the existing validation logic to factor out common validation code into a helper function that can be applied consistently across all resident-only attributes including $STANDARD_INFORMATION, $OBJECT_ID, $VOLUME_INFORMATION, $INDEX_ROOT, and $EA_INFORMATION. This approach aligns with the principles of defensive programming and contract hardening as defined in secure coding standards. The solution addresses the underlying CWE-129 vulnerability related to improper validation of array indices and ensures that all attribute access operations properly validate their data structures before processing. This fix also supports the ATT&CK technique of privilege escalation through kernel exploits by preventing the exploitation path that relies on inconsistent attribute format handling, thus maintaining system integrity and preventing unauthorized access to kernel memory regions.