CVE-2026-72205

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

ntfs: free volume-wide resources on fill_super failure

ntfs_fill_super()'s err_out_now path frees only the volume struct via

kfree(vol), leaving several vol-owned allocations behind on every mount

failure:

- vol->nls_map, loaded by ntfs_init_fs_context() via

load_nls_default() (or replaced by an explicit nls= option in

ntfs_parse_param()), is never unload_nls()'d.

- vol->volume_label, allocated by load_system_files() through

ntfs_ucstonls() once the $Volume name attribute has been parsed, is

not released by load_system_files()'s own error labels nor by the

fill_super() inline cleanup that only runs on d_make_root()

failure. Any later failure inside load_system_files() leaks it.

- vol->lcn_empty_bits_per_page was kvfree()'d in

unl_upcase_iput_tmp_ino_err_out_now without clearing the pointer,

so it could not be folded into a single common cleanup.

Because the failure paths nev

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References