CVE-2026-72204ntfs: centalize $INDEX_ROOT header validation
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: ntfs: centalize $INDEX_ROOT header validation Add a dedicated helper to perform stricter validation of $INDEX_ROOT and use it for both directory inodes and named index inodes. This keeps the root size and header geometry checks consistent across both read paths.
- CVSS
- 8.4 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Aug 18, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 0a8ac0c1fa0b99a5b29002bc7f232ed7eafddef0 before b06730c6af58d3569883f8dd7c36a90aba5ecc0a; from 0a8ac0c1fa0b99a5b29002bc7f232ed7eafddef0 before 8b97b302f553a480fb76d2afd53cd6c0635a9dcd | CNA record |
References
- https://git.kernel.org/stable/c/b06730c6af58d3569883f8dd7c36a90aba5ecc0a
- https://git.kernel.org/stable/c/8b97b302f553a480fb76d2afd53cd6c0635a9dcd
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.