{"answers":{"affected":"","exploited":"There is no known exploitation of CVE-2026-72187 in the wild and no public exploit code.","fix":"Apply the vendor's patch.","what":"CVE-2026-72187 is a denial of service vulnerability in Linux, published on 15 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-72187 and fix it if it is affected.\n\nWhat it is: CVE-2026-72187 is a denial of service vulnerability in Linux, published on 15 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2026-72187 in the wild and no public exploit code.\n\nAffected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-72187/ (Markdown: https://insights.sbomify.com/CVE-2026-72187/index.md)","id":"CVE-2026-72187","markdown":"https://insights.sbomify.com/CVE-2026-72187/index.md","name":"CVE-2026-72187","record":{"aliases":["DEBIAN-CVE-2026-72187","GHSA-f35h-7767-j6v8","UBUNTU-CVE-2026-72187"],"analysis":{"component_type":"kernel","fix_type":"patch","impacts":["denial_of_service"],"network_reachable":"adjacent_or_local","non_default_config":false,"product_category":"Linux kernel","requires_auth":"none","summary":"A self-deadlock in the Linux kernel NTFS driver during inode eviction can cause a local denial of service.","user_interaction":"not_required","vuln_class":"denial_of_service"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"Linux","cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\nntfs: avoid self-deadlock during inode eviction\n\nAn attribute-list update performed while allocating clusters can drop the\nlast reference to the temporary attribute inode. Evicting that inode\ndrops its reference to the base inode and can invoke ntfs_drop_big_inode()\nfor the base inode from within the base inode's own writeback path.\n\nIf the base inode is unlinked, ntfs_drop_big_inode() calls\ntruncate_setsize(), which waits for the inode's folio writeback to\ncomplete. The same writeback worker is responsible for completing that\nwriteback, so it waits for itself indefinitely.\n\nPrevent this self-deadlock by grabbing a reference to the base inode at the\nbeginning of ntfs_writepages() and releasing it at the end of the function.\nThis defers eviction until all bios have been submitted, allowing the wait\nfor folio writeback to complete safely.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"ntfs: avoid self-deadlock during inode eviction","id":"CVE-2026-72187","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"denial_of_service","year":"2026"},"n_packages":0,"n_references":2,"next":{"headline":"ntfs: sanitize MFT references returned from ntfs_lookup_inode_by_name()","id":"CVE-2026-72188"},"packages":[],"prev":{"headline":"ntfs: make system files immutable to prevent corruption","id":"CVE-2026-72186"},"products":["Linux"],"published":"2026-08-15","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":"PUBLISHED","updated":"2026-08-17","vendors":["Linux"]},"summary":"A self-deadlock in the Linux kernel NTFS driver during inode eviction can cause a local denial of service.","url":"https://insights.sbomify.com/CVE-2026-72187/"}