CVE-2026-72193 - Vulnerability Details

- ntfs3: cap RESTART_TABLE free-chain walker at rt->used

Description

In the Linux kernel, the following vulnerability has been resolved:

ntfs3: cap RESTART_TABLE free-chain walker at rt->used

A crafted NTFS3 disk image triggers an in-kernel infinite loop at
mount time, hanging the mounting thread and firing the soft-lockup
watchdog within ~22s on multi-CPU hosts (panic with
kernel.softlockup_panic=1). The bug is reachable from desktop USB
auto-mount on distributions where udisks2 routes the NTFS signature
to the in-tree ntfs3 driver (Arch family and an increasing fraction
of Fedora / openSUSE / RHEL deployments); CAP_SYS_ADMIN-class manual
mount elsewhere.

check_rstbl()'s second walker iterates the free-entry singly-linked
list headed by rt->first_free with no upper bound on iteration count:

for (off = ff; off;) {
if (off == RESTART_ENTRY_ALLOCATED)
return false;
off = le32_to_cpu(*(__le32 *)Add2Ptr(rt, off));
if (off > ts - sizeof(__le32))
return false;
}

The existing guards cover three exits: end-of-list (off == 0), the
in-use marker (off == RESTART_ENTRY_ALLOCATED), and out-of-bounds
(off > ts - sizeof(__le32)). None of the three prevents an
in-bounds cycle.

A crafted on-disk RESTART_TABLE whose free chain contains a
self-loop or A->B->A cycle whose offsets satisfy:

- in range [sizeof(struct RESTART_TABLE), ts - sizeof(__le32)]
- (off - sizeof(struct RESTART_TABLE)) % rsize == 0

passes all existing guards and spins the mount-time thread forever.
Reproduced in UML by hand-forging a 2 MB NTFS3 image whose journal
RESTART_TABLE first_free = 0x18 and whose entry at offset 0x18
stores 0x18 as its next pointer; mount of the forged image with
the in-tree ntfs3 driver never returns.

Bound the walker by rt->used. Each entry on a legitimate free
chain is unique, and the total slot count is ne = le16_to_cpu
(rt->used). A traversal that visits more than ne slots is by
construction malformed; reject it as a corrupt RESTART_TABLE.

After this patch, mount of the forged image returns with -EINVAL
and a log_replay failure message, and mkntfs-produced legitimate
images mount cleanly (verified in the same UML harness).

Published: 2026-08-15

Score: 5.5 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

A crafted NTFS3 disk image can trigger an infinite loop in the ntfs3 driver’s free‑chain walker while mounting. The loop stalls the mounting thread and activates the kernel soft‑lockup watchdog; on systems with panic enabled the kernel may crash. This denial of service prevents normal operation of the affected system.

Affected Systems

Linux machines that use the kernel’s built‑in ntfs3 driver and rely on udisks2 to auto‑mount NTFS volumes are impacted. Distributions such as Arch, Fedora, openSUSE, RHEL, and others that route the NTFS signature to ntfs3 are included. All kernel releases prior to the patch that bounds the traversal are vulnerable.

Risk and Exploitability

The vulnerability is not listed in CISA KEV. The EPSS score is < 1%, and its CVSS score is 5.5, indicating a moderate severity. The failure can be reproduced with a simple disk image, making exploitation straightforward for anyone who can provide the image to the mount process, either via a USB device or an authorised manual mount. The attack causes a soft‑lockup within roughly 22 seconds on multi‑CPU hosts, which can lead to a kernel panic if panic is enabled. No public exploit has been reported, yet the low preparation cost and high impact make it a serious DoS vector.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`b46acd6a6a627d876898e1c84d3f84902264b445`	affected	< 8128bec895075253c779d67afdc90ae513265fca
`b46acd6a6a627d876898e1c84d3f84902264b445`	affected	< 7972df425687daa70d971fe6ed415e78683133dd
`b46acd6a6a627d876898e1c84d3f84902264b445`	affected	< 7ac4c86915c24c208a0f0611b71d9676686fe756
`b46acd6a6a627d876898e1c84d3f84902264b445`	affected	< 29b86dbe88cbbef53bb9aaec2e279359f8c450f8
`b46acd6a6a627d876898e1c84d3f84902264b445`	affected	< 0fad25687d4d3fa1fdd313d31b9cb5817c425029
`b46acd6a6a627d876898e1c84d3f84902264b445`	affected	< d313416280d41bea272f02a6034dfa88008692a0
`b46acd6a6a627d876898e1c84d3f84902264b445`	affected	< 9611f644302c07d21bc8af97e3e06a3d30064253

Linux

affected

Version	Status	Constraints
`5.15`	affected	—
`0`	unaffected	< 5.15
`5.15.212`	unaffected	≤ 5.15.*
`6.1.178`	unaffected	≤ 6.1.*
`6.6.145`	unaffected	≤ 6.6.*
`6.12.97`	unaffected	≤ 6.12.*
`6.18.40`	unaffected	≤ 6.18.*
`7.1.5`	unaffected	≤ 7.1.*
`7.2`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[b46acd6a6a627d876898e1c84d3f84902264b445,8128bec895075253c779d67afdc90ae513265fca)`	affected	generic	—
`[b46acd6a6a627d876898e1c84d3f84902264b445,7972df425687daa70d971fe6ed415e78683133dd)`	affected	generic	—
`[b46acd6a6a627d876898e1c84d3f84902264b445,7ac4c86915c24c208a0f0611b71d9676686fe756)`	affected	generic	—
`[b46acd6a6a627d876898e1c84d3f84902264b445,29b86dbe88cbbef53bb9aaec2e279359f8c450f8)`	affected	generic	—
`[b46acd6a6a627d876898e1c84d3f84902264b445,0fad25687d4d3fa1fdd313d31b9cb5817c425029)`	affected	generic	—
`[b46acd6a6a627d876898e1c84d3f84902264b445,d313416280d41bea272f02a6034dfa88008692a0)`	affected	generic	—
`[b46acd6a6a627d876898e1c84d3f84902264b445,9611f644302c07d21bc8af97e3e06a3d30064253)`	affected	generic	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`5.15`	affected	generic	—
`[0,5.15)`	unaffected	generic	—
`[5.15.212,5.15.*]`	unaffected	generic	—
`[6.1.178,6.1.*]`	unaffected	generic	—
`[6.6.145,6.6.*]`	unaffected	generic	—
`[6.12.97,6.12.*]`	unaffected	generic	—
`[6.18.40,6.18.*]`	unaffected	generic	—
`[7.1.5,7.1.*]`	unaffected	generic	—
`[7.2-rc1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Update the Linux kernel to a version that contains the ntfs3 free‑chain traversal patch.
Confirm that udisks2 uses the kernel‑built ntfs3 driver instead of an external or custom NTFS driver.
If immediate patching is not possible, avoid mounting untrusted NTFS volumes, especially on removable media; consider disabling automatic mounts when the system is exposed to unknown devices.
Continuously monitor kernel logs for ntfs3‑related soft‑lockup or panic messages.

Generated by OpenCVE AI on August 22, 2026 at 10:41 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00211.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/0fad25687d4d3fa1fdd313d31b9cb5817c425029
https://git.kernel.org/stable/c/29b86dbe88cbbef53bb9aaec2e279359f8c450f8
https://git.kernel.org/stable/c/7972df425687daa70d971fe6ed415e78683133dd
https://git.kernel.org/stable/c/7ac4c86915c24c208a0f0611b71d9676686fe756
https://git.kernel.org/stable/c/8128bec895075253c779d67afdc90ae513265fca
https://git.kernel.org/stable/c/9611f644302c07d21bc8af97e3e06a3d30064253
https://git.kernel.org/stable/c/d313416280d41bea272f02a6034dfa88008692a0
https://lore.kernel.org/linux-cve-announce/2026081542-CVE-2026-72193-7785@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-72193
https://www.cve.org/CVERecord?id=CVE-2026-72193

History

Sat, 22 Aug 2026 09:30:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-665 CWE-666

Wed, 19 Aug 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-835
References		https://lore.kernel.org/linux-cve-announce/2026081542-CVE-2026-72193-7785@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-72193 https://www.cve.org/CVERecord?id=CVE-2026-72193
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Sat, 15 Aug 2026 20:00:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-665 CWE-666

Sat, 15 Aug 2026 06:00:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: ntfs3: cap RESTART_TABLE free-chain walker at rt->used A crafted NTFS3 disk image triggers an in-kernel infinite loop at mount time, hanging the mounting thread and firing the soft-lockup watchdog within ~22s on multi-CPU hosts (panic with kernel.softlockup_panic=1). The bug is reachable from desktop USB auto-mount on distributions where udisks2 routes the NTFS signature to the in-tree ntfs3 driver (Arch family and an increasing fraction of Fedora / openSUSE / RHEL deployments); CAP_SYS_ADMIN-class manual mount elsewhere. check_rstbl()'s second walker iterates the free-entry singly-linked list headed by rt->first_free with no upper bound on iteration count: for (off = ff; off;) { if (off == RESTART_ENTRY_ALLOCATED) return false; off = le32_to_cpu((__le32 )Add2Ptr(rt, off)); if (off > ts - sizeof(__le32)) return false; } The existing guards cover three exits: end-of-list (off == 0), the in-use marker (off == RESTART_ENTRY_ALLOCATED), and out-of-bounds (off > ts - sizeof(__le32)). None of the three prevents an in-bounds cycle. A crafted on-disk RESTART_TABLE whose free chain contains a self-loop or A->B->A cycle whose offsets satisfy: - in range [sizeof(struct RESTART_TABLE), ts - sizeof(__le32)] - (off - sizeof(struct RESTART_TABLE)) % rsize == 0 passes all existing guards and spins the mount-time thread forever. Reproduced in UML by hand-forging a 2 MB NTFS3 image whose journal RESTART_TABLE first_free = 0x18 and whose entry at offset 0x18 stores 0x18 as its next pointer; mount of the forged image with the in-tree ntfs3 driver never returns. Bound the walker by rt->used. Each entry on a legitimate free chain is unique, and the total slot count is ne = le16_to_cpu (rt->used). A traversal that visits more than ne slots is by construction malformed; reject it as a corrupt RESTART_TABLE. After this patch, mount of the forged image returns with -EINVAL and a log_replay failure message, and mkntfs-produced legitimate images mount cleanly (verified in the same UML harness).
Title		ntfs3: cap RESTART_TABLE free-chain walker at rt->used
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/0fad25687d4d3fa1fdd313d31b9cb5817c425029 https://git.kernel.org/stable/c/29b86dbe88cbbef53bb9aaec2e279359f8c450f8 https://git.kernel.org/stable/c/7972df425687daa70d971fe6ed415e78683133dd https://git.kernel.org/stable/c/7ac4c86915c24c208a0f0611b71d9676686fe756 https://git.kernel.org/stable/c/8128bec895075253c779d67afdc90ae513265fca https://git.kernel.org/stable/c/9611f644302c07d21bc8af97e3e06a3d30064253 https://git.kernel.org/stable/c/d313416280d41bea272f02a6034dfa88008692a0

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-08-15T05:53:53.381Z

Updated: 2026-08-17T05:10:01.666Z

Reserved: 2026-08-09T03:40:39.911Z

Link: CVE-2026-72193

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-08-15T06:21:37.797

Modified: 2026-08-17T06:18:19.947

Link: CVE-2026-72193

Redhat

Severity : Moderate

Publid Date: 2026-08-15T00:00:00Z

Links: CVE-2026-72193 - Bugzilla

OpenCVE Enrichment

Updated: 2026-08-22T10:45:03Z

Weaknesses

CWE-835
Loop with Unreachable Exit Condition ('Infinite Loop')

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object