CVE-2026-72188
CriticalCVSS 9.1Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
In the Linux kernel's NTFS filesystem, ntfs_lookup_inode_by_name() returns MFT references read from directory index entries on disk, which are untrusted. The function can return an error-marked MFT reference without validation, causing callers to misinterpret the result. The fix normalizes all such references to ERR_MREF(-EIO) across all four return paths.
Risk Assessment
A crafted NTFS image could cause the system to use a bogus pseudo-errno instead of treating the lookup as corrupted metadata, potentially leading to unpredictable behavior or system crashes.
Recommendation
Apply the Linux kernel update containing this fix to ensure MFT references are validated and avoid errors from untrusted on-disk data.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: ntfs: sanitize MFT references returned from ntfs_lookup_inode_by_name() ntfs_lookup_inode_by_name() returns MFT references read from directory index entries on disk. These values are untrusted, but the function can currently return an error-marked MFT reference to its callers without validating it. Callers later decode lookup failures with MREF_ERR(). A crafted NTFS image can set the MREF error bit while leaving the low bits as an arbitrary value, causing callers to consume a bogus pseudo-errno instead of treating the lookup result as corrupted on-disk metadata. Fix this at the source by normalizing every error-marked MFT reference returned from ntfs_lookup_inode_by_name() to ERR_MREF(-EIO). Apply this to all four directory lookup return paths so every caller gets a validated result without needing additional checks or an API change. This keeps the sanitization in the common lookup helper, which is cleaner than duplicating validation in each caller.