Unauthenticated Remote Vulnerability in Linux Linux Kernel Rates 9.8 CVSS

Last refreshed2026-10-15

Status: UPDATED | Advisory ID: CVE-2026-72477

Key Details

CVE	CVE-2026-72477
CVSS Score / Version	9.8 (Critical) / CVSS v3.1
Updated	2026-10-15
CVSS Vector	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`
CVSS Prose	attack vector is network; attack complexity is low; privileges required is none; user interaction is none; scope is unchanged; confidentiality impact is high; integrity impact is high; availability impact is high.
Affected products	Linux Kernel
Exploitation prediction (EPSS)	0.55% probability of exploitation in the next 30 days (45% percentile) -- FIRST.org's EPSS model.

Vendor	Product	Affected Versions	Patch Status
Linux	Linux Kernel

Vendor

Product

Affected Versions

Patch Status

Linux

Linux Kernel

Subsystems	OT Supporting Infrastructure
Sectors	All Sectors

In the Linux kernel, the following vulnerability has been resolved:

fs/ntfs3: call _ntfs_bad_inode() when failing to rename

It is safe to call _ntfs_bad_inode on live inodes since:

commit 519b078998ce ("fs/ntfs3: Exclude call make_bad_inode for live nodes.")

The WARN_ON was added when it wasn't safe by:

commit d99208b91933 ("fs/ntfs3: cancle set bad inode after removing name fails")

Replace the WARN_ON with a call to _ntfs_bad_inode() to prevent further

operations on the inconsistent inode.

Monitor Linux's web page for any future patch releases.

Source	Reference
NVD	https://nvd.nist.gov/vuln/detail/CVE-2026-72477
CVE	https://www.cve.org/CVERecord?id=CVE-2026-72477

Source

Reference

NVD

CVE