Strix
57K

CVE-2026-72194

CRITICALCVSS 9.8/10EPSS 0.22%

Last modified

CVE-2026-72194 is a critical-severity vulnerability rated 9.8/10 on the CVSS scale. In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: add depth limit to indx_find_buffer to prevent stack overflow indx_find_buffer() recursively descends the B+ tree index with no depth limit. A crafted NTFS image with circular index node references causes unbounded recursion, overflowing the kernel stack and panicking the system. This is reachable by mounting a malicious NTFS filesystem (e.g. EPSS estimates a 0.22% chance of exploitation in the next 30 days.

Description

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: add depth limit to indx_find_buffer to prevent stack overflow indx_find_buffer() recursively descends the B+ tree index with no depth limit. A crafted NTFS image with circular index node references causes unbounded recursion, overflowing the kernel stack and panicking the system. This is reachable by mounting a malicious NTFS filesystem (e.g. from a USB drive via desktop automount) and deleting a file whose index entry triggers the rebalancing fallback path in indx_delete_entry(). Add a depth parameter and bail out with -EINVAL when it reaches the fnd->nodes array bound, matching the constraint already enforced by fnd_push() in indx_find(). The related function indx_find() was previously patched for a similar infinite-loop issue (commit 1732053c8a6b), but indx_find_buffer() was missed.

Metrics

CVSS 3.1
9.8/10

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Probability
0.22%

13.1th percentile

Probability of exploitation in the next 30 days. Learn more

Affected Software

Source: CNA advisory (CVE.org). NVD analysis pending.

VendorProductVersions
LinuxLinux>= 82cae269cfa953032fbb8980a7d554d60fb00b17, < 99031d4f63c785d2a985b6a4c64c4256f7117052; >= 82cae269cfa953032fbb8980a7d554d60fb00b17, < 65357a81f64cb3fbe13b4b937586755e4b3a072f; >= 82cae269cfa953032fbb8980a7d554d60fb00b17, < 96fb64f9da86fd2dbd78fbe9d9e41ae27e12ce34; >= 82cae269cfa953032fbb8980a7d554d60fb00b17, < 78612f478f9fadcec4f9b3b089970da67ffb47e9; >= 82cae269cfa953032fbb8980a7d554d60fb00b17, < 908c9243ba309997b73cbda3e4c563d0fb345ee9; >= 82cae269cfa953032fbb8980a7d554d60fb00b17, < fdf50c788e0991e42a187ff75479a0df7fb752f1; >= 82cae269cfa953032fbb8980a7d554d60fb00b17, < 1ebd684b8f627f75bc3e03f8b2ad8400fd1f02cd
LinuxLinux5.15

References

Timeline

Published
Last Modified
Status
Received

Frequently Asked Questions

What is CVE-2026-72194?
In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: add depth limit to indx_find_buffer to prevent stack overflow indx_find_buffer() recursively descends the B+ tree index with no depth limit. A crafted NTFS image with circular index node references causes unbounded recursion, overflowing the kernel stack and panicking the system. This is reachable by mounting a malicious NTFS filesystem (e.g. from a USB drive via desktop automount) and deleting a file whose index entry triggers the rebalancing fallback path in indx_delete_entry(). Add a depth parameter and bail out with -EINVAL when it reaches the fnd->nodes array bound, matching the constraint already enforced by fnd_push() in indx_find(). The related function indx_find() was previously patched for a similar infinite-loop issue (commit 1732053c8a6b), but indx_find_buffer() was missed.
How severe is CVE-2026-72194?
CVE-2026-72194 has a CVSS score of 9.8/10 (CRITICAL severity). The EPSS model estimates a 0.22% probability of exploitation in the next 30 days.
How do I fix CVE-2026-72194?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

How Strix Helps

Related CVEs from 2026

View all 2026CVEs →

Are you affected by CVE-2026-72194?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST