Description
In the Linux kernel, the following vulnerability has been resolved:

ntfs: avoid heap allocation for free-cluster readahead state

get_nr_free_clusters() allocates a temporary file_ra_state before it
publishes the precomputed free cluster count, sets NVolFreeClusterKnown(),
and wakes vol->free_waitq. If that allocation fails, the worker returns
without setting the flag or waking waiters, so callers waiting for the free
count can block indefinitely.

The readahead state is only used synchronously while scanning the bitmap.
Keep it on the stack and pass it by address to the readahead helper. This
eliminates the early allocation failure path instead of adding a special
case that publishes a conservative count and wakes the waitqueue.
Zero-initialize the on-stack state because file_ra_state_init() only sets
ra_pages and prev_pos.

Apply the same treatment to __get_nr_free_mft_records(), which scans the
MFT bitmap with the same short-lived readahead state.
Published: 2026-08-15
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The kernel’s free‑cluster count routine in the NTFS driver allocates a temporary readahead structure. When that allocation fails the routine exits without setting a flag or waking the wait‑queue, causing any caller waiting for the pre‑computed free‑cluster count to block forever. This can lead to a denial of service by stalling system operations that depend on free‑cluster information.

Affected Systems

All Linux systems that use the kernel module for NTFS file systems are affected, regardless of distribution or specific kernel release, as the vulnerability concerns the generic Linux kernel driver and not a vendor‑specific product.

Risk and Exploitability

Based on the description, it is inferred that the vulnerability requires kernel‑level access to trigger, implying that only local or privileged attackers can exploit it. The EPSS score is <1%, indicating a low probability of exploitation, while a CVSS score of 7.5 reflects high severity. The issue is not listed in the CISA KEV catalog, but the potential for indefinite blocking makes it high risk. Without the patch, a failed allocation path can cause processes to hang while waiting for free‑cluster updates, leading to service disruption.

Generated by OpenCVE AI on August 22, 2026 at 08:46 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the Linux kernel to a version that includes the fix introduced in commits 40ee64e6 and c0513207
  • If a kernel upgrade is not yet possible, avoid mounting or interacting with NTFS volumes that rely on free‑cluster count queries until the patch is applied
  • Use system monitoring to detect processes stalled on vol->free_waitq and take remedial action (e.g., restart services) as a temporary measure

Generated by OpenCVE AI on August 22, 2026 at 08:46 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 19 Aug 2026 00:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-833
References
Metrics threat_severity

None

 threat_severity

Moderate

Mon, 17 Aug 2026 19:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-398
CWE-404

Mon, 17 Aug 2026 17:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-676
CWE-703
CWE-770

Mon, 17 Aug 2026 06:00:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

Sat, 15 Aug 2026 20:00:00 +0000

Type Values Removed Values Added
Weaknesses CWE-676
CWE-703
CWE-770

Sat, 15 Aug 2026 06:00:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: ntfs: avoid heap allocation for free-cluster readahead state get_nr_free_clusters() allocates a temporary file_ra_state before it publishes the precomputed free cluster count, sets NVolFreeClusterKnown(), and wakes vol->free_waitq. If that allocation fails, the worker returns without setting the flag or waking waiters, so callers waiting for the free count can block indefinitely. The readahead state is only used synchronously while scanning the bitmap. Keep it on the stack and pass it by address to the readahead helper. This eliminates the early allocation failure path instead of adding a special case that publishes a conservative count and wakes the waitqueue. Zero-initialize the on-stack state because file_ra_state_init() only sets ra_pages and prev_pos. Apply the same treatment to __get_nr_free_mft_records(), which scans the MFT bitmap with the same short-lived readahead state.
Title ntfs: avoid heap allocation for free-cluster readahead state
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Subscriptions

Linux Linux Kernel
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-08-18T06:56:20.164Z

Reserved: 2026-08-09T03:40:39.912Z

Link: CVE-2026-72202

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-08-15T06:21:38.860

Modified: 2026-08-18T07:16:53.560

Link: CVE-2026-72202

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-08-15T00:00:00Z

Links: CVE-2026-72202 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-08-22T09:00:10Z

Weaknesses