Vulnerability-Lookup

GHSA-R757-M3XV-CW84

Vulnerability from github – Published: 2026-08-15 06:32 – Updated: 2026-08-17 06:33

Details

In the Linux kernel, the following vulnerability has been resolved:

ntfs: avoid heap allocation for free-cluster readahead state

get_nr_free_clusters() allocates a temporary file_ra_state before it publishes the precomputed free cluster count, sets NVolFreeClusterKnown(), and wakes vol->free_waitq. If that allocation fails, the worker returns without setting the flag or waking waiters, so callers waiting for the free count can block indefinitely.

The readahead state is only used synchronously while scanning the bitmap. Keep it on the stack and pass it by address to the readahead helper. This eliminates the early allocation failure path instead of adding a special case that publishes a conservative count and wakes the waitqueue. Zero-initialize the on-stack state because file_ra_state_init() only sets ra_pages and prev_pos.

Apply the same treatment to __get_nr_free_mft_records(), which scans the MFT bitmap with the same short-lived readahead state.

Severity

7.5 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-72202"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-08-15T06:21:38Z",
    "severity": "HIGH"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nntfs: avoid heap allocation for free-cluster readahead state\n\nget_nr_free_clusters() allocates a temporary file_ra_state before it\npublishes the precomputed free cluster count, sets NVolFreeClusterKnown(),\nand wakes vol-\u003efree_waitq. If that allocation fails, the worker returns\nwithout setting the flag or waking waiters, so callers waiting for the free\ncount can block indefinitely.\n\nThe readahead state is only used synchronously while scanning the bitmap.\nKeep it on the stack and pass it by address to the readahead helper. This\neliminates the early allocation failure path instead of adding a special\ncase that publishes a conservative count and wakes the waitqueue.\nZero-initialize the on-stack state because file_ra_state_init() only sets\nra_pages and prev_pos.\n\nApply the same treatment to __get_nr_free_mft_records(), which scans the\nMFT bitmap with the same short-lived readahead state.",
  "id": "GHSA-r757-m3xv-cw84",
  "modified": "2026-08-17T06:33:16Z",
  "published": "2026-08-15T06:32:15Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-72202"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/40ee64e633e5e413f2255bb48c063977d8c86f34"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/c05132077df57a384919f61d7f8a8e76d748a6d4"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

CVE-2026-72202 (GCVE-0-2026-72202)

Vulnerability from cvelistv5 – Published: 2026-08-15 05:53 – Updated: 2026-08-18 06:56

Title

ntfs: avoid heap allocation for free-cluster readahead state

Summary

In the Linux kernel, the following vulnerability has been resolved: ntfs: avoid heap allocation for free-cluster readahead state get_nr_free_clusters() allocates a temporary file_ra_state before it publishes the precomputed free cluster count, sets NVolFreeClusterKnown(), and wakes vol->free_waitq. If that allocation fails, the worker returns without setting the flag or waking waiters, so callers waiting for the free count can block indefinitely. The readahead state is only used synchronously while scanning the bitmap. Keep it on the stack and pass it by address to the readahead helper. This eliminates the early allocation failure path instead of adding a special case that publishes a conservative count and wakes the waitqueue. Zero-initialize the on-stack state because file_ra_state_init() only sets ra_pages and prev_pos. Apply the same treatment to __get_nr_free_mft_records(), which scans the MFT bitmap with the same short-lived readahead state.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Assigner

Linux mitre root

References

2 references

URL	Tags
https://git.kernel.org/stable/c/40ee64e633e5e413f…
https://git.kernel.org/stable/c/c05132077df57a384…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 6251f0b0de7d645e3591931ca4c11d8322c1866f , < 40ee64e633e5e413f2255bb48c063977d8c86f34 (git) Affected: 6251f0b0de7d645e3591931ca4c11d8322c1866f , < c05132077df57a384919f61d7f8a8e76d748a6d4 (git)
Linux	Linux	Affected: 7.1 Unaffected: 0 , < 7.1 (semver) Unaffected: 7.1.5 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/ntfs/super.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "40ee64e633e5e413f2255bb48c063977d8c86f34",
              "status": "affected",
              "version": "6251f0b0de7d645e3591931ca4c11d8322c1866f",
              "versionType": "git"
            },
            {
              "lessThan": "c05132077df57a384919f61d7f8a8e76d748a6d4",
              "status": "affected",
              "version": "6251f0b0de7d645e3591931ca4c11d8322c1866f",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/ntfs/super.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "7.1"
            },
            {
              "lessThan": "7.1",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "7.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "7.1",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nntfs: avoid heap allocation for free-cluster readahead state\n\nget_nr_free_clusters() allocates a temporary file_ra_state before it\npublishes the precomputed free cluster count, sets NVolFreeClusterKnown(),\nand wakes vol-\u003efree_waitq. If that allocation fails, the worker returns\nwithout setting the flag or waking waiters, so callers waiting for the free\ncount can block indefinitely.\n\nThe readahead state is only used synchronously while scanning the bitmap.\nKeep it on the stack and pass it by address to the readahead helper. This\neliminates the early allocation failure path instead of adding a special\ncase that publishes a conservative count and wakes the waitqueue.\nZero-initialize the on-stack state because file_ra_state_init() only sets\nra_pages and prev_pos.\n\nApply the same treatment to __get_nr_free_mft_records(), which scans the\nMFT bitmap with the same short-lived readahead state."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - fs/ntfs registers ntfs_export_ops; on servers with an rw-mounted NTFS volume exported via nfsd or ksmbd, remote NFS/SMB statfs, write, and fallocate RPCs reach ntfs_statfs, ntfs_fallocate, and iomap allocation paths that block on vol-\u003efree_waitq when precalc never publishes NVolFreeClusterKnown.\nAC:L - A local attacker can hold the system under GFP_NOFS memory pressure across NTFS mount so the tiny file_ra_state kzalloc in precalc_free_clusters fails; once that broken state exists, any statfs/write/fallocate caller deterministically enters wait_event without races or victim-specific layout.\nPR:N - Exploitation at trigger time needs only access to the mounted/exported NTFS volume (e.g., remote NFS/SMB statfs or write permission); no CAP_SYS_ADMIN, root, or init-namespace privileges are required on the server to hit the indefinite waitqueue block.\nUI:N - After an administrator has rw-mounted and optionally exported the NTFS volume (or automounted dual-boot/shared storage), attackers drive normal statfs or write operations that hang on free_waitq; no per-attack victim clicks, opens, or cooperative actions are required beyond that standing configuration.\nS:U - Impact is indefinite blocking of kernel threads serving the affected NTFS volume within the host kernel security authority; this is standard filesystem denial of service, not a VM escape, container breakout, or IOMMU boundary bypass.\nC:N - The bug is a missing wake on kzalloc failure in get_nr_free_clusters; it does not corrupt memory, read out of bounds, or use-after-free, and provides no kernel pointer leak or arbitrary memory disclosure primitive.\nI:N - Failed precalc leaves free-cluster accounting unpublished and stalls I/O waiters; it does not modify on-disk NTFS metadata or in-memory file contents beyond denying forward progress to blocked callers.\nA:H - After precalc aborts without NVolSetFreeClusterKnown or wake_up_all, wait_event(vol-\u003efree_waitq, NVolFreeClusterKnown) never completes, permanently hanging statfs, writes, fallocate, and cluster alloc/free paths (D-state), including nfsd/ksmbd worker threads serving the export."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-18T06:56:20.164Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/40ee64e633e5e413f2255bb48c063977d8c86f34"
        },
        {
          "url": "https://git.kernel.org/stable/c/c05132077df57a384919f61d7f8a8e76d748a6d4"
        }
      ],
      "title": "ntfs: avoid heap allocation for free-cluster readahead state",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-72202",
    "datePublished": "2026-08-15T05:53:59.587Z",
    "dateReserved": "2026-08-09T03:40:39.912Z",
    "dateUpdated": "2026-08-18T06:56:20.164Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

GHSA-R757-M3XV-CW84

CVE-2026-72202 (GCVE-0-2026-72202)

Tags

Sightings

Nomenclature