Linux Kernel up to 7.1.4/7.2-rc2 ntfs deadlock

Summaryinfo

A vulnerability marked as problematic has been reported in Linux Kernel up to 7.1.4/7.2-rc2. Affected by this issue is some unknown functionality of the component ntfs. The manipulation leads to deadlock. This vulnerability is documented as CVE-2026-72186. The attack can be initiated remotely. There is not any exploit available.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in Linux Kernel up to 7.1.4/7.2-rc2. This issue affects an unknown code of the component ntfs. The manipulation with an unknown input leads to a deadlock vulnerability. Using CWE to declare the problem leads to CWE-833. The product contains multiple threads or executable segments that are waiting for each other to release a necessary lock, resulting in deadlock. Impacted is integrity, and availability. The summary by CVE is:

In the Linux kernel, the following vulnerability has been resolved: ntfs: make system files immutable to prevent corruption When a system file such as $Bitmap is exposed via show_sys_files and written from userspace, the volume is corrupted and, because the cluster allocator scans $Bitmap through the same inode's page cache, a write to $Bitmap also deadlocks writeback against the folio it already holds locked. These files are maintained by the driver itself and have no valid reason to be written through the file interface. Mark base metadata files (mft_no < FILE_first_user) as immutable during inode read so the VFS rejects write, mmap, truncate and unlink with -EPERM. Directories are skipped so the root and $Extend remain usable. Internal metadata updates do not go through the VFS write path and are unaffected.

It is possible to read the advisory at git.kernel.org. The identification of this vulnerability is CVE-2026-72186 since 08/09/2026. The exploitation is known to be easy. The attack may be initiated remotely. The technical details are unknown and an exploit is not publicly available. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 08/15/2026). The attack technique deployed by this issue is T1499 according to MITRE ATT&CK.

Upgrading to version 7.1.5 or 7.2-rc3 eliminates this vulnerability. Applying the patch 8f313e92522ac41d273ea137db13ea8a8df2beed/f72df3a4c33b64de3418ec74d1ad4f028e09d161 is able to eliminate this problem.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

Version

• 7.1.0
• 7.1.1
• 7.1.2
• 7.1.3
• 7.1.4
• 7.2-rc1
• 7.2-rc2

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion