CVE-2026-72353

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

ntfs: avoid stale runlist element dereference in fallocate

ntfs_attr_fallocate() allocates holes and delayed allocations inside

initialized size by looking up the current runlist element under

ni->runlist.lock. The returned struct runlist_element is only a borrowed

pointer into ni->runlist.rl. A writer can replace and free that array

after the read lock is dropped, so later reads of rl->lcn, rl->length and

rl->vcn can touch freed memory.

The buggy scenario involves two paths, with each column showing the order

within that path:

ntfs_attr_fallocate():

1. Take ni->runlist.lock for read.

2. Get rl from ntfs_attr_find_vcn_nolock().

3. Drop ni->runlist.lock.

4. Read rl->lcn, rl->length and rl->vcn.

mmap page_mkwrite:

1. Enter ntfs_filemap_page_mkwrite().

2. Reach __ntfs_write_iomap_begin() and ntfs_attr_map_cluster().

3. Merge allocation state with ntfs_runlists_merge().

4. Reallocate ni->runlist.rl in

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References