First day on Intigriti: our agent harness found and proved a remote code execution bug in Odoo's program.

CVE-2026-72208

CriticalCVSS 9.8/10Last modified Aug 18, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

ntfs: add bounds check before accessing EA entries

in ntfs_ea_lookup and ntfs_listxattr, this verifies that there is enough space in the EA entry before accessing the next_entry_offset field of the EA entry.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
Linux	Linux	>= c451d34ae14201c2bb40652bf74072a79ff82f7d, < d9d9925de1d8f233cc60d3dc356e12f232f97c15; >= c451d34ae14201c2bb40652bf74072a79ff82f7d, < 937282f7d15b593d0be765fa2ced164130ec87f7
Linux	Linux	7.1

References

Timeline

Published: Aug 15, 2026
Last modified: Aug 18, 2026
NVD status: Received

Related CVEs from 2026

CVE-2026-722099.8In the Linux kernel, the following vulnerability has been resolved: ntfs: validate attribute values on lookup ntfs_attr_find() and ntfs_ex CVE-2026-72217.3A vulnerability was found in TencentCloudBase CloudBase-MCP up to 2.17.0. Affected is the function openUrl of the file mcp/src/interactive-s CVE-2026-722109.8In the Linux kernel, the following vulnerability has been resolved: ntfs: fix off-by-one in mapping pairs decoding bounds checks In ntfs_m CVE-2026-722119.8In the Linux kernel, the following vulnerability has been resolved: ntfs: grow index root value before reparent header update ntfs_ir_repa CVE-2026-72212In the Linux kernel, the following vulnerability has been resolved: mm/memory_hotplug: fix incorrect altmap passing in error path In creat CVE-2026-722137.1In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb: fix hugetlb cgroup rsvd charge/uncharge mismatch In alloc_CVE-2026-72214In the Linux kernel, the following vulnerability has been resolved: power: supply: cpcap-battery: Fix missing nvmem_device_put() causing re CVE-2026-72215In the Linux kernel, the following vulnerability has been resolved: MIPS: DEC: Ensure 32-bit stack location for o32 prom_printf() In 64-bi CVE-2026-72216In the Linux kernel, the following vulnerability has been resolved: remoteproc: qcom: Fix leak when custom dump_segments addition fails Fr CVE-2026-722179.8In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Bound-check xdr_buf_to_bvec() stores before writing xdr_buf_to CVE-2026-72218In the Linux kernel, the following vulnerability has been resolved: lockd: Plug nlm_file refcount leak on cached nlm_do_fopen() failure Th CVE-2026-72219In the Linux kernel, the following vulnerability has been resolved: lockd: Plug nlm_file leak when nlm_do_fopen() fails A client can repea

CVE-2026-72208: Critical severity, CVSS 9.8 | Vulnix