CVE-2026-72188

In the Linux kernel, the following vulnerability has been resolved: ntfs: sanitize MFT references returned from ntfs_lookup_inode_by_name() ntfs_lookup_inode_by_name() returns MFT references read from directory index entries on disk. These values are untrusted, but the function can currently return an error-marked MFT reference to its callers without validating it. Callers later decode lookup failures with MREF_ERR(). A crafted NTFS image can set the MREF error bit while leaving the low bits as an arbitrary value, causing callers to consume a bogus pseudo-errno instead of treating the lookup result as corrupted on-disk metadata. Fix this at the source by normalizing every error-marked MFT reference returned from ntfs_lookup_inode_by_name() to ERR_MREF(-EIO). Apply this to all four directory lookup return paths so every caller gets a validated result without needing additional checks or an API change. This keeps the sanitization in the common lookup helper, which is cleaner than duplicating validation in each caller.

• https://git.kernel.org/stable/c/83f396d881c4fd312c7fd5fff2c157fc21104464
• https://git.kernel.org/stable/c/d97a36bae86a9a4021562ded2987f904e6bcb1d7

Published

Aug 15, 2026

Last Modified

Aug 17, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-72182In the Linux kernel, the following vulnerability has been re…
• CVE-2026-72183In the Linux kernel, the following vulnerability has been re…8.4
• CVE-2026-72184In the Linux kernel, the following vulnerability has been re…
• CVE-2026-72185In the Linux kernel, the following vulnerability has been re…9.8
• CVE-2026-72186In the Linux kernel, the following vulnerability has been re…9.1
• CVE-2026-72187In the Linux kernel, the following vulnerability has been re…
• CVE-2026-72189In the Linux kernel, the following vulnerability has been re…
• CVE-2026-7219A flaw has been found in Totolink N300RT 3.4.0-B20250430. Th…7.3
• CVE-2026-72190In the Linux kernel, the following vulnerability has been re…
• CVE-2026-72191In the Linux kernel, the following vulnerability has been re…9.8
• CVE-2026-72192In the Linux kernel, the following vulnerability has been re…9.8
• CVE-2026-72193In the Linux kernel, the following vulnerability has been re…