GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-72202 (GCVE-0-2026-72202)

Vulnerability from cvelistv5 – Published: 2026-08-15 05:53 – Updated: 2026-08-18 06:56
VLAI
Title
ntfs: avoid heap allocation for free-cluster readahead state
Summary
In the Linux kernel, the following vulnerability has been resolved: ntfs: avoid heap allocation for free-cluster readahead state get_nr_free_clusters() allocates a temporary file_ra_state before it publishes the precomputed free cluster count, sets NVolFreeClusterKnown(), and wakes vol->free_waitq. If that allocation fails, the worker returns without setting the flag or waking waiters, so callers waiting for the free count can block indefinitely. The readahead state is only used synchronously while scanning the bitmap. Keep it on the stack and pass it by address to the readahead helper. This eliminates the early allocation failure path instead of adding a special case that publishes a conservative count and wakes the waitqueue. Zero-initialize the on-stack state because file_ra_state_init() only sets ra_pages and prev_pos. Apply the same treatment to __get_nr_free_mft_records(), which scans the MFT bitmap with the same short-lived readahead state.
Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 6251f0b0de7d645e3591931ca4c11d8322c1866f , < 40ee64e633e5e413f2255bb48c063977d8c86f34 (git)
Affected: 6251f0b0de7d645e3591931ca4c11d8322c1866f , < c05132077df57a384919f61d7f8a8e76d748a6d4 (git)
guessed Create a notification for this product.
Linux Linux Affected: 7.1
Unaffected: 0 , < 7.1 (semver)
Unaffected: 7.1.5 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/ntfs/super.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "40ee64e633e5e413f2255bb48c063977d8c86f34",
              "status": "affected",
              "version": "6251f0b0de7d645e3591931ca4c11d8322c1866f",
              "versionType": "git"
            },
            {
              "lessThan": "c05132077df57a384919f61d7f8a8e76d748a6d4",
              "status": "affected",
              "version": "6251f0b0de7d645e3591931ca4c11d8322c1866f",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/ntfs/super.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "7.1"
            },
            {
              "lessThan": "7.1",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "7.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "7.1",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nntfs: avoid heap allocation for free-cluster readahead state\n\nget_nr_free_clusters() allocates a temporary file_ra_state before it\npublishes the precomputed free cluster count, sets NVolFreeClusterKnown(),\nand wakes vol-\u003efree_waitq. If that allocation fails, the worker returns\nwithout setting the flag or waking waiters, so callers waiting for the free\ncount can block indefinitely.\n\nThe readahead state is only used synchronously while scanning the bitmap.\nKeep it on the stack and pass it by address to the readahead helper. This\neliminates the early allocation failure path instead of adding a special\ncase that publishes a conservative count and wakes the waitqueue.\nZero-initialize the on-stack state because file_ra_state_init() only sets\nra_pages and prev_pos.\n\nApply the same treatment to __get_nr_free_mft_records(), which scans the\nMFT bitmap with the same short-lived readahead state."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - fs/ntfs registers ntfs_export_ops; on servers with an rw-mounted NTFS volume exported via nfsd or ksmbd, remote NFS/SMB statfs, write, and fallocate RPCs reach ntfs_statfs, ntfs_fallocate, and iomap allocation paths that block on vol-\u003efree_waitq when precalc never publishes NVolFreeClusterKnown.\nAC:L - A local attacker can hold the system under GFP_NOFS memory pressure across NTFS mount so the tiny file_ra_state kzalloc in precalc_free_clusters fails; once that broken state exists, any statfs/write/fallocate caller deterministically enters wait_event without races or victim-specific layout.\nPR:N - Exploitation at trigger time needs only access to the mounted/exported NTFS volume (e.g., remote NFS/SMB statfs or write permission); no CAP_SYS_ADMIN, root, or init-namespace privileges are required on the server to hit the indefinite waitqueue block.\nUI:N - After an administrator has rw-mounted and optionally exported the NTFS volume (or automounted dual-boot/shared storage), attackers drive normal statfs or write operations that hang on free_waitq; no per-attack victim clicks, opens, or cooperative actions are required beyond that standing configuration.\nS:U - Impact is indefinite blocking of kernel threads serving the affected NTFS volume within the host kernel security authority; this is standard filesystem denial of service, not a VM escape, container breakout, or IOMMU boundary bypass.\nC:N - The bug is a missing wake on kzalloc failure in get_nr_free_clusters; it does not corrupt memory, read out of bounds, or use-after-free, and provides no kernel pointer leak or arbitrary memory disclosure primitive.\nI:N - Failed precalc leaves free-cluster accounting unpublished and stalls I/O waiters; it does not modify on-disk NTFS metadata or in-memory file contents beyond denying forward progress to blocked callers.\nA:H - After precalc aborts without NVolSetFreeClusterKnown or wake_up_all, wait_event(vol-\u003efree_waitq, NVolFreeClusterKnown) never completes, permanently hanging statfs, writes, fallocate, and cluster alloc/free paths (D-state), including nfsd/ksmbd worker threads serving the export."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-18T06:56:20.164Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/40ee64e633e5e413f2255bb48c063977d8c86f34"
        },
        {
          "url": "https://git.kernel.org/stable/c/c05132077df57a384919f61d7f8a8e76d748a6d4"
        }
      ],
      "title": "ntfs: avoid heap allocation for free-cluster readahead state",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-72202",
    "datePublished": "2026-08-15T05:53:59.587Z",
    "dateReserved": "2026-08-09T03:40:39.912Z",
    "dateUpdated": "2026-08-18T06:56:20.164Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-72202",
      "date": "2026-09-10",
      "epss": "0.00468",
      "percentile": "0.39058"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-72202\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-08-15T06:21:38.860\",\"lastModified\":\"2026-08-18T07:16:53.560\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nntfs: avoid heap allocation for free-cluster readahead state\\n\\nget_nr_free_clusters() allocates a temporary file_ra_state before it\\npublishes the precomputed free cluster count, sets NVolFreeClusterKnown(),\\nand wakes vol-\u003efree_waitq. If that allocation fails, the worker returns\\nwithout setting the flag or waking waiters, so callers waiting for the free\\ncount can block indefinitely.\\n\\nThe readahead state is only used synchronously while scanning the bitmap.\\nKeep it on the stack and pass it by address to the readahead helper. This\\neliminates the early allocation failure path instead of adding a special\\ncase that publishes a conservative count and wakes the waitqueue.\\nZero-initialize the on-stack state because file_ra_state_init() only sets\\nra_pages and prev_pos.\\n\\nApply the same treatment to __get_nr_free_mft_records(), which scans the\\nMFT bitmap with the same short-lived readahead state.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"fs/ntfs/super.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6251f0b0de7d645e3591931ca4c11d8322c1866f\",\"lessThan\":\"40ee64e633e5e413f2255bb48c063977d8c86f34\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"6251f0b0de7d645e3591931ca4c11d8322c1866f\",\"lessThan\":\"c05132077df57a384919f61d7f8a8e76d748a6d4\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"fs/ntfs/super.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"7.1\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"7.1\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.5\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/40ee64e633e5e413f2255bb48c063977d8c86f34\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/c05132077df57a384919f61d7f8a8e76d748a6d4\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-18T15:52:09+00:00",
      "cve": "CVE-2026-72202",
      "id": "CVE-2026-72202",
      "initial_release_date": "2026-08-15T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: ntfs: avoid heap allocation for free-cluster readahead state",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-72202.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-31T16:27:07Z",
      "cve": "CVE-2026-72202",
      "id": "CVE-2026-72202",
      "initial_release_date": "2026-08-31T16:27:07Z",
      "product_status:known_not_affected": "362",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-72202",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-72202.json",
      "version": "2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.