CVE-2026-72194

Last refreshed2026-10-17

Status: UPDATED | Advisory ID: CVE-2026-72194

Key Details

CVE	CVE-2026-72194
CVSS Score / Version	9.8 (Critical) / CVSS v3.1
Updated	2026-10-16
CVSS Vector	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`
CVSS Prose	attack vector is network; attack complexity is low; privileges required is none; user interaction is none; scope is unchanged; confidentiality impact is high; integrity impact is high; availability impact is high.
Affected products	Linux Kernel

Vendor	Product	Affected Versions	Patch Status
Linux	Linux Kernel

Vendor

Product

Affected Versions

Patch Status

Linux

Linux Kernel

Subsystems	OT Supporting Infrastructure
Sectors	All Sectors

In the Linux kernel, the following vulnerability has been resolved:

fs/ntfs3: add depth limit to indx_find_buffer to prevent stack overflow

indx_find_buffer() recursively descends the B+ tree index with no depth

limit. A crafted NTFS image with circular index node references causes

unbounded recursion, overflowing the kernel stack and panicking the

system.

This is reachable by mounting a malicious NTFS filesystem (e.g. from a

USB drive via desktop automount) and deleting a file whose index entry

triggers the rebalancing fallback path in indx_delete_entry().

Add a depth parameter and bail out with -EINVAL when it reaches the

fnd->nodes array bound, matching the constraint already enforced by

fnd_push() in indx_find().

The related function indx_find() was previously patched for a similar

infinite-loop issue (commit 1732053c8a6b), but indx_find_buffer() was

missed. (NVD)

Monitor Linux's web page for any future patch releases.

Source	Reference
NVD	https://nvd.nist.gov/vuln/detail/CVE-2026-72194
CVE	https://www.cve.org/CVERecord?id=CVE-2026-72194

Source

Reference

NVD

CVE