CVE-2026-72189

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ntfs: fail attrlist updates when the superblock is inactive

generic_shutdown_super() clears SB_ACTIVE before evicting cached inodes.

If eviction selects the fake inode for a base inode's unnamed

$ATTRIBUTE_LIST attribute, ntfs_evict_big_inode() drops the fake inode's

reference on the base inode while the fake inode is still hashed and marked

I_FREEING.

That iput can synchronously write back the base inode. The writeback path

may update mapping pairs and call ntfs_attrlist_update(), which

unconditionally calls ntfs_attr_iget() for the same $ATTRIBUTE_LIST fake

inode. VFS then finds the I_FREEING inode and waits for eviction to finish,

but the current task is still inside that eviction path, causing a

self-deadlock in find_inode().

Fix this by mirroring the teardown guard used by __ntfs_write_inode():

once SB_ACTIVE has been cleared, do not try to iget the attribute-list

fake inode. Return -EIO so teardown aborts the

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References