CVE-2026-72206

CriticalCVSS 9.8/10Last modified Aug 18, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

ntfs: validate index block header more strictly

Modify ntfs_index_block_inconsisent() to perform stricter validation of INDEX_HEADER geometry in INDX blocks, and update ntfs_lookup_inode_by_name() to use that function to validate INDX blocks.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Aug 15, 2026
Last modified
Aug 18, 2026
NVD status
Received

Related CVEs from 2026

CVE-2026-722079.8In the Linux kernel, the following vulnerability has been resolved: ntfs: not change 0-byte $DATA attribute to non-resident When ntfs_resiCVE-2026-722089.8In the Linux kernel, the following vulnerability has been resolved: ntfs: add bounds check before accessing EA entries in ntfs_ea_lookup aCVE-2026-722099.8In the Linux kernel, the following vulnerability has been resolved: ntfs: validate attribute values on lookup ntfs_attr_find() and ntfs_exCVE-2026-72217.3A vulnerability was found in TencentCloudBase CloudBase-MCP up to 2.17.0. Affected is the function openUrl of the file mcp/src/interactive-sCVE-2026-722109.8In the Linux kernel, the following vulnerability has been resolved: ntfs: fix off-by-one in mapping pairs decoding bounds checks In ntfs_mCVE-2026-722119.8In the Linux kernel, the following vulnerability has been resolved: ntfs: grow index root value before reparent header update ntfs_ir_repaCVE-2026-72212In the Linux kernel, the following vulnerability has been resolved: mm/memory_hotplug: fix incorrect altmap passing in error path In creatCVE-2026-722137.1In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb: fix hugetlb cgroup rsvd charge/uncharge mismatch In alloc_CVE-2026-72214In the Linux kernel, the following vulnerability has been resolved: power: supply: cpcap-battery: Fix missing nvmem_device_put() causing reCVE-2026-72215In the Linux kernel, the following vulnerability has been resolved: MIPS: DEC: Ensure 32-bit stack location for o32 prom_printf() In 64-biCVE-2026-72216In the Linux kernel, the following vulnerability has been resolved: remoteproc: qcom: Fix leak when custom dump_segments addition fails FrCVE-2026-722179.8In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Bound-check xdr_buf_to_bvec() stores before writing xdr_buf_to
CVE-2026-72206: Critical severity, CVSS 9.8 | Vulnix