GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-72354 (GCVE-0-2026-72354)

Vulnerability from cvelistv5 – Published: 2026-08-15 05:55 – Updated: 2026-08-17 05:43
VLAI
Title
ntfs: avoid stale runlist element dereference in MFT writeback
Summary
In the Linux kernel, the following vulnerability has been resolved: ntfs: avoid stale runlist element dereference in MFT writeback ntfs_write_mft_block() maps each $MFT record through the $MFT data runlist. For sub-folio clusters it looks up a struct runlist_element under ni->runlist.lock, drops the lock, and later uses rl->length and rl->vcn when choosing folio_sz. That pointer is only borrowed from ni->runlist.rl. Concurrent $MFT allocation extension can merge a replacement runlist under the same lock, and ntfs_rl_realloc() can free the old backing array. If that happens between the lookup and the later folio_sz decision, writeback can dereference freed runlist storage. The buggy scenario involves two paths, with each column showing the order within that path: MFT writeback path: $MFT allocation extension: 1. Look up rl under 1. Extend the $MFT data allocation. ni->runlist.lock. 2. Publish a replacement runlist. 2. Drop ni->runlist.lock. 3. Free the old runlist array. 3. Read rl->length and rl->vcn to choose folio_sz. Compute the remaining run length while ni->runlist.lock is still held, and use that scalar after unlock. This preserves the existing folio sizing decision without carrying a borrowed runlist_element across the lock boundary. Validation reproduced this kernel report: BUG: KASAN: slab-use-after-free in ntfs_mft_writepages+0x1c8d/0x1fb0 Call Trace: <TASK> dump_stack_lvl+0x66/0xa0 print_report+0xce/0x630 ? ntfs_mft_writepages+0x1c8d/0x1fb0 ? srso_alias_return_thunk+0x5/0xfbef5 ? __virt_addr_valid+0x20d/0x410 ? ntfs_mft_writepages+0x1c8d/0x1fb0 kasan_report+0xe0/0x110 ? ntfs_mft_writepages+0x1c8d/0x1fb0 ntfs_mft_writepages+0x1c8d/0x1fb0 ? __pfx_ntfs_mft_writepages+0x10/0x10 ? __pfx___mutex_unlock_slowpath+0x10/0x10 ? srso_alias_return_thunk+0x5/0xfbef5 ? iput+0x92/0xa80 do_writepages+0x219/0x530 ? __pfx_do_writepages+0x10/0x10 __writeback_single_inode+0x117/0xf50 ? do_raw_spin_lock+0x130/0x270 ? __pfx_do_raw_spin_lock+0x10/0x10 ? __pfx___writeback_single_inode+0x10/0x10 ? srso_alias_return_thunk+0x5/0xfbef5 writeback_sb_inodes+0x65b/0x1810 ? srso_alias_return_thunk+0x5/0xfbef5 ? lock_acquire+0x2b8/0x2f0 ? __pfx_writeback_sb_inodes+0x10/0x10 ? lock_release+0x1e0/0x280 ? _raw_spin_unlock+0x23/0x40 ? move_expired_inodes+0x2b8/0x850 __writeback_inodes_wb+0xf4/0x270 ? __pfx___writeback_inodes_wb+0x10/0x10 ? srso_alias_return_thunk+0x5/0xfbef5 ? queue_io+0x2e4/0x410 wb_writeback+0x666/0x880 ? srso_alias_return_thunk+0x5/0xfbef5 ? __pfx_wb_writeback+0x10/0x10 ? srso_alias_return_thunk+0x5/0xfbef5 ? srso_alias_return_thunk+0x5/0xfbef5 ? get_nr_dirty_inodes+0x1c/0x170 wb_workfn+0x75e/0xbb0 ? srso_alias_return_thunk+0x5/0xfbef5 ? _raw_spin_unlock_irqrestore+0x27/0x60 ? __pfx_wb_workfn+0x10/0x10 ? __pfx_debug_object_deactivate+0x10/0x10 ? lock_acquire+0x2b8/0x2f0 ? srso_alias_return_thunk+0x5/0xfbef5 ? lock_release+0x1e0/0x280 process_one_work+0x8d0/0x1870 ? __pfx_process_one_work+0x10/0x10 ? srso_alias_return_thunk+0x5/0xfbef5 worker_thread+0x575/0xf80 ? __pfx_worker_thread+0x10/0x10 kthread+0x2e7/0x3c0 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x576/0x810 ? __pfx_ret_from_fork+0x10/0x10 ? srso_alias_return_thunk+0x5/0xfbef5 ? __switch_to+0x57e/0xe10 ? __switch_to_asm+0x33/0x70 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1a/0x30 </TASK> Allocated by task 970: kasan_save_stack+0x33/0x60 kasan_save_track+0x14/0x30 __kasan_kmalloc+0xaa/0xb0 __kvmalloc_node_noprof+0x353/0x920 ntfs_rl_realloc+0x3c/0x80 ntfs_runlists_merge+0x1212/0x3010 ntfs_mft_data_extend_allocation_nolock+0x3e0/0x1f40 ntfs_mft_record_alloc+0x1ab4/0x4f10 __ntfs_create+0x680/0x2e50 ntfs_create+0x1e6/0x3a0 path_openat+0x2b55/0x3c10 do_file_open+0x1f4/0x460 do_sys_openat2+0xde/0x170 __x64_sys_openat+0x122/0x1e0 do_syscall_64+0x115/0x6a0 entry_SYSCALL_64_after_hwframe+0x77/0x7f Freed by task 1294: kasan_save_ ---truncated---
Severity
8.8 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 115380f9a2f9675c7924563cbba70d40cae8fb81 , < 9a2e36963a3fc52401586657d34e3f1c5a01ea56 (git)
Affected: 115380f9a2f9675c7924563cbba70d40cae8fb81 , < 81fe702ff1760da32bcd3ef4494b2a33dbeced72 (git)
guessed Create a notification for this product.
Linux Linux Affected: 7.1
Unaffected: 0 , < 7.1 (semver)
Unaffected: 7.1.5 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/ntfs/mft.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "9a2e36963a3fc52401586657d34e3f1c5a01ea56",
              "status": "affected",
              "version": "115380f9a2f9675c7924563cbba70d40cae8fb81",
              "versionType": "git"
            },
            {
              "lessThan": "81fe702ff1760da32bcd3ef4494b2a33dbeced72",
              "status": "affected",
              "version": "115380f9a2f9675c7924563cbba70d40cae8fb81",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/ntfs/mft.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "7.1"
            },
            {
              "lessThan": "7.1",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "7.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "7.1",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nntfs: avoid stale runlist element dereference in MFT writeback\n\nntfs_write_mft_block() maps each $MFT record through the $MFT data\nrunlist. For sub-folio clusters it looks up a struct runlist_element under\nni-\u003erunlist.lock, drops the lock, and later uses rl-\u003elength and rl-\u003evcn\nwhen choosing folio_sz.\n\nThat pointer is only borrowed from ni-\u003erunlist.rl. Concurrent $MFT\nallocation extension can merge a replacement runlist under the same lock,\nand ntfs_rl_realloc() can free the old backing array. If that happens\nbetween the lookup and the later folio_sz decision, writeback can\ndereference freed runlist storage.\n\nThe buggy scenario involves two paths, with each column showing the order\nwithin that path:\n\nMFT writeback path:               $MFT allocation extension:\n1. Look up rl under               1. Extend the $MFT data allocation.\n   ni-\u003erunlist.lock.              2. Publish a replacement runlist.\n2. Drop ni-\u003erunlist.lock.         3. Free the old runlist array.\n3. Read rl-\u003elength and rl-\u003evcn\n   to choose folio_sz.\n\nCompute the remaining run length while ni-\u003erunlist.lock is still held, and\nuse that scalar after unlock. This preserves the existing folio sizing\ndecision without carrying a borrowed runlist_element across the lock\nboundary.\n\nValidation reproduced this kernel report:\nBUG: KASAN: slab-use-after-free in ntfs_mft_writepages+0x1c8d/0x1fb0\n\nCall Trace:\n \u003cTASK\u003e\n dump_stack_lvl+0x66/0xa0\n print_report+0xce/0x630\n ? ntfs_mft_writepages+0x1c8d/0x1fb0\n ? srso_alias_return_thunk+0x5/0xfbef5\n ? __virt_addr_valid+0x20d/0x410\n ? ntfs_mft_writepages+0x1c8d/0x1fb0\n kasan_report+0xe0/0x110\n ? ntfs_mft_writepages+0x1c8d/0x1fb0\n ntfs_mft_writepages+0x1c8d/0x1fb0\n ? __pfx_ntfs_mft_writepages+0x10/0x10\n ? __pfx___mutex_unlock_slowpath+0x10/0x10\n ? srso_alias_return_thunk+0x5/0xfbef5\n ? iput+0x92/0xa80\n do_writepages+0x219/0x530\n ? __pfx_do_writepages+0x10/0x10\n __writeback_single_inode+0x117/0xf50\n ? do_raw_spin_lock+0x130/0x270\n ? __pfx_do_raw_spin_lock+0x10/0x10\n ? __pfx___writeback_single_inode+0x10/0x10\n ? srso_alias_return_thunk+0x5/0xfbef5\n writeback_sb_inodes+0x65b/0x1810\n ? srso_alias_return_thunk+0x5/0xfbef5\n ? lock_acquire+0x2b8/0x2f0\n ? __pfx_writeback_sb_inodes+0x10/0x10\n ? lock_release+0x1e0/0x280\n ? _raw_spin_unlock+0x23/0x40\n ? move_expired_inodes+0x2b8/0x850\n __writeback_inodes_wb+0xf4/0x270\n ? __pfx___writeback_inodes_wb+0x10/0x10\n ? srso_alias_return_thunk+0x5/0xfbef5\n ? queue_io+0x2e4/0x410\n wb_writeback+0x666/0x880\n ? srso_alias_return_thunk+0x5/0xfbef5\n ? __pfx_wb_writeback+0x10/0x10\n ? srso_alias_return_thunk+0x5/0xfbef5\n ? srso_alias_return_thunk+0x5/0xfbef5\n ? get_nr_dirty_inodes+0x1c/0x170\n wb_workfn+0x75e/0xbb0\n ? srso_alias_return_thunk+0x5/0xfbef5\n ? _raw_spin_unlock_irqrestore+0x27/0x60\n ? __pfx_wb_workfn+0x10/0x10\n ? __pfx_debug_object_deactivate+0x10/0x10\n ? lock_acquire+0x2b8/0x2f0\n ? srso_alias_return_thunk+0x5/0xfbef5\n ? lock_release+0x1e0/0x280\n process_one_work+0x8d0/0x1870\n ? __pfx_process_one_work+0x10/0x10\n ? srso_alias_return_thunk+0x5/0xfbef5\n worker_thread+0x575/0xf80\n ? __pfx_worker_thread+0x10/0x10\n kthread+0x2e7/0x3c0\n ? __pfx_kthread+0x10/0x10\n ret_from_fork+0x576/0x810\n ? __pfx_ret_from_fork+0x10/0x10\n ? srso_alias_return_thunk+0x5/0xfbef5\n ? __switch_to+0x57e/0xe10\n ? __switch_to_asm+0x33/0x70\n ? __pfx_kthread+0x10/0x10\n ret_from_fork_asm+0x1a/0x30\n \u003c/TASK\u003e\n\nAllocated by task 970:\n kasan_save_stack+0x33/0x60\n kasan_save_track+0x14/0x30\n __kasan_kmalloc+0xaa/0xb0\n __kvmalloc_node_noprof+0x353/0x920\n ntfs_rl_realloc+0x3c/0x80\n ntfs_runlists_merge+0x1212/0x3010\n ntfs_mft_data_extend_allocation_nolock+0x3e0/0x1f40\n ntfs_mft_record_alloc+0x1ab4/0x4f10\n __ntfs_create+0x680/0x2e50\n ntfs_create+0x1e6/0x3a0\n path_openat+0x2b55/0x3c10\n do_file_open+0x1f4/0x460\n do_sys_openat2+0xde/0x170\n __x64_sys_openat+0x122/0x1e0\n do_syscall_64+0x115/0x6a0\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nFreed by task 1294:\n kasan_save_\n---truncated---"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - Remote clients can reach ntfs_create/ntfs_mft_record_alloc via ksmbd, NFS, or Samba on an rw-mounted NTFS export, racing the kernel $MFT writeback worker without local shell access.\nAC:L - The attacker controls concurrent file creation that extends $MFT allocation while dirty MFT folios write back; the fix commit documents a reproducible KASAN UAF from this attacker-influenced race.\nPR:L - Only filesystem write permission on an rw-mounted NTFS volume is required (local unprivileged user or authenticated network share client), not real root in the initial mount namespace.\nUI:N - No victim interaction is needed; the attacker triggers metadata writes and relies on automatic writeback once $MFT pages are dirty.\nS:U - Impact is confined to kernel NTFS/$MFT writeback on the host; it does not cross VM, hypervisor, or IOMMU security boundaries.\nC:H - Slab use-after-free of runlist_element fields permits reading freed or attacker-influenced kernel memory, matching UAF arbitrary-read exploitation potential.\nI:H - Freed runlist contents control folio_sz and bio sizing for $MFT writeback, enabling misdirected kernel writes and standard UAF-based arbitrary write primitives.\nA:H - Reproduced as KASAN slab-use-after-free in ntfs_mft_writepages; stale runlist dereference can oops or panic the kernel during the race."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:43:12.145Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/9a2e36963a3fc52401586657d34e3f1c5a01ea56"
        },
        {
          "url": "https://git.kernel.org/stable/c/81fe702ff1760da32bcd3ef4494b2a33dbeced72"
        }
      ],
      "title": "ntfs: avoid stale runlist element dereference in MFT writeback",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-72354",
    "datePublished": "2026-08-15T05:55:56.163Z",
    "dateReserved": "2026-08-09T03:40:39.921Z",
    "dateUpdated": "2026-08-17T05:43:12.145Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-72354",
      "date": "2026-09-15",
      "epss": "0.00508",
      "percentile": "0.41962"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-72354\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-08-15T06:22:08.840\",\"lastModified\":\"2026-08-17T06:18:39.540\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nntfs: avoid stale runlist element dereference in MFT writeback\\n\\nntfs_write_mft_block() maps each $MFT record through the $MFT data\\nrunlist. For sub-folio clusters it looks up a struct runlist_element under\\nni-\u003erunlist.lock, drops the lock, and later uses rl-\u003elength and rl-\u003evcn\\nwhen choosing folio_sz.\\n\\nThat pointer is only borrowed from ni-\u003erunlist.rl. Concurrent $MFT\\nallocation extension can merge a replacement runlist under the same lock,\\nand ntfs_rl_realloc() can free the old backing array. If that happens\\nbetween the lookup and the later folio_sz decision, writeback can\\ndereference freed runlist storage.\\n\\nThe buggy scenario involves two paths, with each column showing the order\\nwithin that path:\\n\\nMFT writeback path:               $MFT allocation extension:\\n1. Look up rl under               1. Extend the $MFT data allocation.\\n   ni-\u003erunlist.lock.              2. Publish a replacement runlist.\\n2. Drop ni-\u003erunlist.lock.         3. Free the old runlist array.\\n3. Read rl-\u003elength and rl-\u003evcn\\n   to choose folio_sz.\\n\\nCompute the remaining run length while ni-\u003erunlist.lock is still held, and\\nuse that scalar after unlock. This preserves the existing folio sizing\\ndecision without carrying a borrowed runlist_element across the lock\\nboundary.\\n\\nValidation reproduced this kernel report:\\nBUG: KASAN: slab-use-after-free in ntfs_mft_writepages+0x1c8d/0x1fb0\\n\\nCall Trace:\\n \u003cTASK\u003e\\n dump_stack_lvl+0x66/0xa0\\n print_report+0xce/0x630\\n ? ntfs_mft_writepages+0x1c8d/0x1fb0\\n ? srso_alias_return_thunk+0x5/0xfbef5\\n ? __virt_addr_valid+0x20d/0x410\\n ? ntfs_mft_writepages+0x1c8d/0x1fb0\\n kasan_report+0xe0/0x110\\n ? ntfs_mft_writepages+0x1c8d/0x1fb0\\n ntfs_mft_writepages+0x1c8d/0x1fb0\\n ? __pfx_ntfs_mft_writepages+0x10/0x10\\n ? __pfx___mutex_unlock_slowpath+0x10/0x10\\n ? srso_alias_return_thunk+0x5/0xfbef5\\n ? iput+0x92/0xa80\\n do_writepages+0x219/0x530\\n ? __pfx_do_writepages+0x10/0x10\\n __writeback_single_inode+0x117/0xf50\\n ? do_raw_spin_lock+0x130/0x270\\n ? __pfx_do_raw_spin_lock+0x10/0x10\\n ? __pfx___writeback_single_inode+0x10/0x10\\n ? srso_alias_return_thunk+0x5/0xfbef5\\n writeback_sb_inodes+0x65b/0x1810\\n ? srso_alias_return_thunk+0x5/0xfbef5\\n ? lock_acquire+0x2b8/0x2f0\\n ? __pfx_writeback_sb_inodes+0x10/0x10\\n ? lock_release+0x1e0/0x280\\n ? _raw_spin_unlock+0x23/0x40\\n ? move_expired_inodes+0x2b8/0x850\\n __writeback_inodes_wb+0xf4/0x270\\n ? __pfx___writeback_inodes_wb+0x10/0x10\\n ? srso_alias_return_thunk+0x5/0xfbef5\\n ? queue_io+0x2e4/0x410\\n wb_writeback+0x666/0x880\\n ? srso_alias_return_thunk+0x5/0xfbef5\\n ? __pfx_wb_writeback+0x10/0x10\\n ? srso_alias_return_thunk+0x5/0xfbef5\\n ? srso_alias_return_thunk+0x5/0xfbef5\\n ? get_nr_dirty_inodes+0x1c/0x170\\n wb_workfn+0x75e/0xbb0\\n ? srso_alias_return_thunk+0x5/0xfbef5\\n ? _raw_spin_unlock_irqrestore+0x27/0x60\\n ? __pfx_wb_workfn+0x10/0x10\\n ? __pfx_debug_object_deactivate+0x10/0x10\\n ? lock_acquire+0x2b8/0x2f0\\n ? srso_alias_return_thunk+0x5/0xfbef5\\n ? lock_release+0x1e0/0x280\\n process_one_work+0x8d0/0x1870\\n ? __pfx_process_one_work+0x10/0x10\\n ? srso_alias_return_thunk+0x5/0xfbef5\\n worker_thread+0x575/0xf80\\n ? __pfx_worker_thread+0x10/0x10\\n kthread+0x2e7/0x3c0\\n ? __pfx_kthread+0x10/0x10\\n ret_from_fork+0x576/0x810\\n ? __pfx_ret_from_fork+0x10/0x10\\n ? srso_alias_return_thunk+0x5/0xfbef5\\n ? __switch_to+0x57e/0xe10\\n ? __switch_to_asm+0x33/0x70\\n ? __pfx_kthread+0x10/0x10\\n ret_from_fork_asm+0x1a/0x30\\n \u003c/TASK\u003e\\n\\nAllocated by task 970:\\n kasan_save_stack+0x33/0x60\\n kasan_save_track+0x14/0x30\\n __kasan_kmalloc+0xaa/0xb0\\n __kvmalloc_node_noprof+0x353/0x920\\n ntfs_rl_realloc+0x3c/0x80\\n ntfs_runlists_merge+0x1212/0x3010\\n ntfs_mft_data_extend_allocation_nolock+0x3e0/0x1f40\\n ntfs_mft_record_alloc+0x1ab4/0x4f10\\n __ntfs_create+0x680/0x2e50\\n ntfs_create+0x1e6/0x3a0\\n path_openat+0x2b55/0x3c10\\n do_file_open+0x1f4/0x460\\n do_sys_openat2+0xde/0x170\\n __x64_sys_openat+0x122/0x1e0\\n do_syscall_64+0x115/0x6a0\\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\\n\\nFreed by task 1294:\\n kasan_save_\\n---truncated---\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"fs/ntfs/mft.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"115380f9a2f9675c7924563cbba70d40cae8fb81\",\"lessThan\":\"9a2e36963a3fc52401586657d34e3f1c5a01ea56\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"115380f9a2f9675c7924563cbba70d40cae8fb81\",\"lessThan\":\"81fe702ff1760da32bcd3ef4494b2a33dbeced72\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"fs/ntfs/mft.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"7.1\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"7.1\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.5\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":8.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.8,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/81fe702ff1760da32bcd3ef4494b2a33dbeced72\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/9a2e36963a3fc52401586657d34e3f1c5a01ea56\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-19T17:39:46+00:00",
      "cve": "CVE-2026-72354",
      "id": "CVE-2026-72354",
      "initial_release_date": "2026-08-15T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: ntfs: avoid stale runlist element dereference in MFT writeback",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-72354.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-01T13:29:35Z",
      "cve": "CVE-2026-72354",
      "id": "CVE-2026-72354",
      "initial_release_date": "2026-09-01T13:29:35Z",
      "product_status:known_not_affected": "362",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-72354",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-72354.json",
      "version": "2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.