CVE-2026-72202

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-72202", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-08-09T03:40:39.912Z", "datePublished": "2026-08-15T05:53:59.587Z", "dateUpdated": "2026-08-18T06:56:20.164Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-18T06:56:20.164Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nntfs: avoid heap allocation for free-cluster readahead state\n\nget_nr_free_clusters() allocates a temporary file_ra_state before it\npublishes the precomputed free cluster count, sets NVolFreeClusterKnown(),\nand wakes vol->free_waitq. If that allocation fails, the worker returns\nwithout setting the flag or waking waiters, so callers waiting for the free\ncount can block indefinitely.\n\nThe readahead state is only used synchronously while scanning the bitmap.\nKeep it on the stack and pass it by address to the readahead helper. This\neliminates the early allocation failure path instead of adding a special\ncase that publishes a conservative count and wakes the waitqueue.\nZero-initialize the on-stack state because file_ra_state_init() only sets\nra_pages and prev_pos.\n\nApply the same treatment to __get_nr_free_mft_records(), which scans the\nMFT bitmap with the same short-lived readahead state."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 7.5, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:N - fs/ntfs registers ntfs_export_ops; on servers with an rw-mounted NTFS volume exported via nfsd or ksmbd, remote NFS/SMB statfs, write, and fallocate RPCs reach ntfs_statfs, ntfs_fallocate, and iomap allocation paths that block on vol->free_waitq when precalc never publishes NVolFreeClusterKnown.\nAC:L - A local attacker can hold the system under GFP_NOFS memory pressure across NTFS mount so the tiny file_ra_state kzalloc in precalc_free_clusters fails; once that broken state exists, any statfs/write/fallocate caller deterministically enters wait_event without races or victim-specific layout.\nPR:N - Exploitation at trigger time needs only access to the mounted/exported NTFS volume (e.g., remote NFS/SMB statfs or write permission); no CAP_SYS_ADMIN, root, or init-namespace privileges are required on the server to hit the indefinite waitqueue block.\nUI:N - After an administrator has rw-mounted and optionally exported the NTFS volume (or automounted dual-boot/shared storage), attackers drive normal statfs or write operations that hang on free_waitq; no per-attack victim clicks, opens, or cooperative actions are required beyond that standing configuration.\nS:U - Impact is indefinite blocking of kernel threads serving the affected NTFS volume within the host kernel security authority; this is standard filesystem denial of service, not a VM escape, container breakout, or IOMMU boundary bypass.\nC:N - The bug is a missing wake on kzalloc failure in get_nr_free_clusters; it does not corrupt memory, read out of bounds, or use-after-free, and provides no kernel pointer leak or arbitrary memory disclosure primitive.\nI:N - Failed precalc leaves free-cluster accounting unpublished and stalls I/O waiters; it does not modify on-disk NTFS metadata or in-memory file contents beyond denying forward progress to blocked callers.\nA:H - After precalc aborts without NVolSetFreeClusterKnown or wake_up_all, wait_event(vol->free_waitq, NVolFreeClusterKnown) never completes, permanently hanging statfs, writes, fallocate, and cluster alloc/free paths (D-state), including nfsd/ksmbd worker threads serving the export."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/ntfs/super.c"], "versions": [{"version": "6251f0b0de7d645e3591931ca4c11d8322c1866f", "lessThan": "40ee64e633e5e413f2255bb48c063977d8c86f34", "status": "affected", "versionType": "git"}, {"version": "6251f0b0de7d645e3591931ca4c11d8322c1866f", "lessThan": "c05132077df57a384919f61d7f8a8e76d748a6d4", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/ntfs/super.c"], "versions": [{"version": "7.1", "status": "affected"}, {"version": "0", "lessThan": "7.1", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.5", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "7.1", "versionEndExcluding": "7.1.5"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "7.1", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/40ee64e633e5e413f2255bb48c063977d8c86f34"}, {"url": "https://git.kernel.org/stable/c/c05132077df57a384919f61d7f8a8e76d748a6d4"}], "title": "ntfs: avoid heap allocation for free-cluster readahead state", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["fs/ntfs/super.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "40ee64e633e5e413f2255bb48c063977d8c86f34", "status": "affected", "version": "6251f0b0de7d645e3591931ca4c11d8322c1866f", "versionType": "git"}, {"lessThan": "c05132077df57a384919f61d7f8a8e76d748a6d4", "status": "affected", "version": "6251f0b0de7d645e3591931ca4c11d8322c1866f", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["fs/ntfs/super.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "7.1"}, {"lessThan": "7.1", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.5", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nntfs: avoid heap allocation for free-cluster readahead state\n\nget_nr_free_clusters() allocates a temporary file_ra_state before it\npublishes the precomputed free cluster count, sets NVolFreeClusterKnown(),\nand wakes vol->free_waitq. If that allocation fails, the worker returns\nwithout setting the flag or waking waiters, so callers waiting for the free\ncount can block indefinitely.\n\nThe readahead state is only used synchronously while scanning the bitmap.\nKeep it on the stack and pass it by address to the readahead helper. This\neliminates the early allocation failure path instead of adding a special\ncase that publishes a conservative count and wakes the waitqueue.\nZero-initialize the on-stack state because file_ra_state_init() only sets\nra_pages and prev_pos.\n\nApply the same treatment to __get_nr_free_mft_records(), which scans the\nMFT bitmap with the same short-lived readahead state."}], "id": "CVE-2026-72202", "lastModified": "2026-08-18T07:16:53.560", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-08-15T06:21:38.860", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/40ee64e633e5e413f2255bb48c063977d8c86f34"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/c05132077df57a384919f61d7f8a8e76d748a6d4"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: ntfs: avoid heap allocation for free-cluster readahead state", "id": "2516375", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2516375"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-833", "details": ["A flaw was found in the Linux kernel's NTFS filesystem driver. When calculating free clusters or Master File Table (MFT) records, a temporary state object is allocated on the heap. If this allocation fails, processes waiting for these counts can become unresponsive, leading to a denial of service (DoS) for the system."], "name": "CVE-2026-72202", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-08-15T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-72202\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-72202\nhttps://lore.kernel.org/linux-cve-announce/2026081543-CVE-2026-72202-5135@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,40ee64e633e5e413f2255bb48c063977d8c86f34)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,c05132077df57a384919f61d7f8a8e76d748a6d4)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,7.1.5)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.1.5,7.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2-rc1,*)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-08-15T18:30:12.219530+00:00", "updated": "2026-08-22T09:00:10.789683+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"], "weaknesses": ["CWE-404", "CWE-398", "CWE-833"]}