CVE-2026-72477

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-72477", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-08-09T03:40:39.934Z", "datePublished": "2026-08-15T05:57:17.035Z", "dateUpdated": "2026-10-15T10:08:45.810Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-15T10:08:45.810Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs/ntfs3: call _ntfs_bad_inode() when failing to rename\n\nIt is safe to call _ntfs_bad_inode on live inodes since:\n commit 519b078998ce (\"fs/ntfs3: Exclude call make_bad_inode for live nodes.\")\n\nThe WARN_ON was added when it wasn't safe by:\n commit d99208b91933 (\"fs/ntfs3: cancle set bad inode after removing name fails\")\n\nReplace the WARN_ON with a call to _ntfs_bad_inode() to prevent further\noperations on the inconsistent inode."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL"}, "scenarios": [{"lang": "en", "value": "AV:N - ntfs3 registers export_operations and rename on an NFS- or SMB-exported NTFS volume reaches ni_rename() through nfsd/ksmbd vfs_rename without any local syscall; hybrid NAS and Windows/Linux file-server deployments are a reasonable high-impact reach path for this VFS rename flaw.\nAC:L - An attacker controls the on-disk NTFS layout and rename arguments so ni_add_name succeeds and both ni_remove_name steps fail deterministically; syzkaller reproduces this with a crafted loop image and no races or victim-specific timing outside attacker influence.\nPR:N - Exploitation needs only permission to rename on an exported NTFS share (including guest/anonymous NFS or SMB write access) or to supply removable media later mounted by the host; no init-namespace root, CAP_SYS_ADMIN, or other elevated host credentials are required.\nUI:N - Once an administrator has mounted and exported the NTFS volume (or automounted dual-boot/shared storage), the attacker triggers the flawed rename directly; no further victim clicks, file opens, or cooperative actions are needed beyond that standing configuration.\nS:U - Impact is kernel heap/metadata corruption and denial of service within the same kernel security authority; this is standard local or network filesystem exploitation, not a VM escape, IOMMU bypass, or cross-scope sandbox breakout.\nC:H - Leaving the inode operable after a failed rename rollback preserves inconsistent MFT/directory index state; subsequent lookups and index walks parse attacker-influenced corrupt metadata, matching ntfs3 guidance to score metadata corruption that can yield kernel memory disclosure as High.\nI:H - Without ni_bad set, further writes, unlinks, and renames continue against mismatched $FILE_NAME and $I30 state, propagating attacker-steerable directory/MFT corruption and heap metadata damage that can be leveraged for arbitrary kernel writes or control-flow hijack.\nA:H - The vulnerable path emits WARN_ON in ni_rename (kernel panic on panic_on_warn) and syzbot also hit a kernel paging fault in folio_wait_bit_common after follow-on operations on the inconsistent inode; any kernel oops, hang, or panic from continued use scores Availability High."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/ntfs3/frecord.c"], "versions": [{"version": "519b078998ce6e729f98dccf35505b4756985d11", "lessThan": "580896e33003845de66c75cd61544cf9d9bfbe15", "status": "affected", "versionType": "git"}, {"version": "519b078998ce6e729f98dccf35505b4756985d11", "lessThan": "ff825bf0521f6da2f30878cbad18ab7b341bc31b", "status": "affected", "versionType": "git"}, {"version": "519b078998ce6e729f98dccf35505b4756985d11", "lessThan": "e8ed78f40eecd0176fda71d673f6957c98e7ffbe", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/ntfs3/frecord.c"], "versions": [{"version": "6.17", "status": "affected"}, {"version": "0", "lessThan": "6.17", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.57", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.5", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.17", "versionEndExcluding": "6.18.57"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.17", "versionEndExcluding": "7.1.5"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.17", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/580896e33003845de66c75cd61544cf9d9bfbe15"}, {"url": "https://git.kernel.org/stable/c/ff825bf0521f6da2f30878cbad18ab7b341bc31b"}, {"url": "https://git.kernel.org/stable/c/e8ed78f40eecd0176fda71d673f6957c98e7ffbe"}], "title": "fs/ntfs3: call _ntfs_bad_inode() when failing to rename", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["fs/ntfs3/frecord.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "580896e33003845de66c75cd61544cf9d9bfbe15", "status": "affected", "version": "519b078998ce6e729f98dccf35505b4756985d11", "versionType": "git"}, {"lessThan": "ff825bf0521f6da2f30878cbad18ab7b341bc31b", "status": "affected", "version": "519b078998ce6e729f98dccf35505b4756985d11", "versionType": "git"}, {"lessThan": "e8ed78f40eecd0176fda71d673f6957c98e7ffbe", "status": "affected", "version": "519b078998ce6e729f98dccf35505b4756985d11", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["fs/ntfs3/frecord.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.17"}, {"lessThan": "6.17", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.57", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.5", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs/ntfs3: call _ntfs_bad_inode() when failing to rename\n\nIt is safe to call _ntfs_bad_inode on live inodes since:\n commit 519b078998ce (\"fs/ntfs3: Exclude call make_bad_inode for live nodes.\")\n\nThe WARN_ON was added when it wasn't safe by:\n commit d99208b91933 (\"fs/ntfs3: cancle set bad inode after removing name fails\")\n\nReplace the WARN_ON with a call to _ntfs_bad_inode() to prevent further\noperations on the inconsistent inode."}], "id": "CVE-2026-72477", "lastModified": "2026-10-15T11:17:44.060", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-08-15T06:22:21.867", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/580896e33003845de66c75cd61544cf9d9bfbe15"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/e8ed78f40eecd0176fda71d673f6957c98e7ffbe"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/ff825bf0521f6da2f30878cbad18ab7b341bc31b"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: fs/ntfs3: call _ntfs_bad_inode() when failing to rename", "id": "2516563", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2516563"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-390", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nfs/ntfs3: call _ntfs_bad_inode() when failing to rename\nIt is safe to call _ntfs_bad_inode on live inodes since:\ncommit 519b078998ce (\"fs/ntfs3: Exclude call make_bad_inode for live nodes.\")\nThe WARN_ON was added when it wasn't safe by:\ncommit d99208b91933 (\"fs/ntfs3: cancle set bad inode after removing name fails\")\nReplace the WARN_ON with a call to _ntfs_bad_inode() to prevent further\noperations on the inconsistent inode.", "A flaw was found in the Linux kernel's NTFS3 file system driver. This vulnerability occurs when a file rename operation fails, potentially leaving the file system in an inconsistent state. This inconsistency could lead to system instability or data integrity issues. The resolution ensures that affected inodes are correctly handled, preventing further operations on inconsistent data structures."], "name": "CVE-2026-72477", "public_date": "2026-08-15T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-72477\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-72477\nhttps://lore.kernel.org/linux-cve-announce/2026081536-CVE-2026-72477-ecea@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[519b078998ce6e729f98dccf35505b4756985d11,ff825bf0521f6da2f30878cbad18ab7b341bc31b)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[519b078998ce6e729f98dccf35505b4756985d11,e8ed78f40eecd0176fda71d673f6957c98e7ffbe)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.17"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,6.17)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.1.5,7.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.2-rc1,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-08-15T12:30:07.844783+00:00", "updated": "2026-08-22T04:45:03.426121+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}