CVE-2026-72204 ntfs: centalize $INDEX_ROOT header validation
Insufficient validation of NTFS index root headers in the Linux kernel allows attackers to trigger memory corruption, potentially leading to code execution or system crashes.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-72204?
CVE-2026-72204 is a high-severity memory corruption vulnerability in Linux, published on 15 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
ntfs: centalize $INDEX_ROOT header validation
Add a dedicated helper to perform stricter validation of $INDEX_ROOT and use it for both directory inodes and named index inodes. This keeps the root size and header geometry checks consistent across both read paths.
Which versions are affected by CVE-2026-72204?
How do I fix CVE-2026-72204?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-72204 being exploited?
There is no known exploitation of CVE-2026-72204 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-72204, GHSA-2vp7-pvhw-wqqx, UBUNTU-CVE-2026-72204.