CVE-2026-72354

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ntfs: avoid stale runlist element dereference in MFT writeback

ntfs_write_mft_block() maps each $MFT record through the $MFT data

runlist. For sub-folio clusters it looks up a struct runlist_element under

ni->runlist.lock, drops the lock, and later uses rl->length and rl->vcn

when choosing folio_sz.

That pointer is only borrowed from ni->runlist.rl. Concurrent $MFT

allocation extension can merge a replacement runlist under the same lock,

and ntfs_rl_realloc() can free the old backing array. If that happens

between the lookup and the later folio_sz decision, writeback can

dereference freed runlist storage.

The buggy scenario involves two paths, with each column showing the order

within that path:

MFT writeback path: $MFT allocation extension:

1. Look up rl under 1. Extend the $MFT data allocation.

ni->runlist.lock. 2. Publish a replacement runlist.

2. Drop ni->runlist.loc

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References