CVE-2026-72198

CVE CVE-2026-72198EUVD EUVD-2026-58956Published 2026-08-15T05:53:56.000ZLast changed 2026-08-19T07:37:22.000ZCVSS 7.8

What the advisory describes

In the Linux kernel, the following vulnerability has been resolved: ntfs: reject non-resident records for resident-only attributes The shared lookup-time attribute validator rejects non-resident $FILE_NAME and $VOLUME_NAME records because their formats require resident values and callers handle returned records as resident attributes. Other resident-only attribute types still pass through the generic non-resident mapping-pairs checks. That leaves real resident/non-resident union confusion paths. Inode load looks up $STANDARD_INFORMATION and then reads data.resident.value_offset without checking a->non_resident. ntfs_inode_sync_standard_information() does the same when updating the standard information value. ntfs_write_volume_flags() also looks up $VOLUME_INFORMATION and reads data.resident.value_offset directly. $INDEX_ROOT callers in dir.c and index.c depend on the same lookup contract before consuming the resident index root value. Reject non-resident records for all resident-only attribute types in the shared validator. Keep the existing $FILE_NAME and $VOLUME_NAME behavior, but factor it through a helper and extend it to $STANDARD_INFORMATION, $OBJECT_ID, $VOLUME_INFORMATION, $INDEX_ROOT, and $EA_INFORMATION. For $OBJECT_ID and $EA_INFORMATION this is contract hardening for resident-only formats; this patch only rejects the non-resident form and does not add new resident value validation for those types.

Source: EUVD (ENISA), in the words of the advisory.

Products the advisory names

These come from the advisory itself, not from any check we performed.

• Linux — Linux 1e9ea7e04472d4e5e12e58c881eaacfb3e49b669 <097cdfd0a55df5af82c9753833f39a8bfadbcfcb; 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <7ffa8f3d30236e0ab897c30bdb01224ff1fe1c89; patch: 7.1.5; patch: 6.9; patch: 7.2; patch: 0; 7.1; 2.6.12; 1e9ea7e04472d4e5e12e58c881eaacfb3e49b669 <b54c9beb90e570bae17a9c18442aeeaf17165ccb

The versions shown are the advisory's own. Patchlage compares no version numbers and derives no judgement from them — which version is installed is something a person has to look up.

Carried in the product catalogue

An estate covering these products can be recorded in Patchlage. An advisory about them appears in the next morning's situation report.

• Linux — Linux

Patchlage reports hits and suspected hits. About everything else this system says nothing — neither this page nor the situation report ever claims that an estate is safe.