CVE-2026-72188

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ntfs: sanitize MFT references returned from ntfs_lookup_inode_by_name()

ntfs_lookup_inode_by_name() returns MFT references read from directory

index entries on disk. These values are untrusted, but the function can

currently return an error-marked MFT reference to its callers without

validating it.

Callers later decode lookup failures with MREF_ERR(). A crafted NTFS image

can set the MREF error bit while leaving the low bits as an arbitrary

value, causing callers to consume a bogus pseudo-errno instead of treating

the lookup result as corrupted on-disk metadata.

Fix this at the source by normalizing every error-marked MFT reference

returned from ntfs_lookup_inode_by_name() to ERR_MREF(-EIO). Apply this to

all four directory lookup return paths so every caller gets a validated

result without needing additional checks or an API change.

This keeps the sanitization in the common lookup helper, which is cleaner

than du

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References