CVE-2026-72477
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
In the Linux kernel, the NTFS3 filesystem has an issue with error handling during file rename. Instead of calling _ntfs_bad_inode() when rename fails, the driver uses WARN_ON, which does not prevent further operations on the inconsistent inode. The fix replaces WARN_ON with a call to _ntfs_bad_inode() to prevent further operations on the corrupted inode.
Risk Assessment
The vulnerability can lead to filesystem inconsistency, potentially resulting in data corruption or system crash. It requires local access and the ability to trigger a failed rename.
Recommendation
Install the patch from the Linux kernel that replaces WARN_ON with a call to _ntfs_bad_inode(). Update the kernel to a patched version.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: call _ntfs_bad_inode() when failing to rename It is safe to call _ntfs_bad_inode on live inodes since: commit 519b078998ce ("fs/ntfs3: Exclude call make_bad_inode for live nodes.") The WARN_ON was added when it wasn't safe by: commit d99208b91933 ("fs/ntfs3: cancle set bad inode after removing name fails") Replace the WARN_ON with a call to _ntfs_bad_inode() to prevent further operations on the inconsistent inode.