{"answers":{"affected":"","exploited":"There is no known exploitation of CVE-2026-72353 in the wild and no public exploit code.","fix":"Apply the vendor's patch.","what":"CVE-2026-72353 is a high-severity use after free vulnerability in Linux, published on 15 Aug 2026. Any signed-in user can exploit it over the network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-72353 and fix it if it is affected.\n\nWhat it is: CVE-2026-72353 is a high-severity use after free vulnerability in Linux, published on 15 Aug 2026. Any signed-in user can exploit it over the network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2026-72353 in the wild and no public exploit code.\n\nAffected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-72353/ (Markdown: https://insights.sbomify.com/CVE-2026-72353/index.md)","id":"CVE-2026-72353","markdown":"https://insights.sbomify.com/CVE-2026-72353/index.md","name":"CVE-2026-72353","record":{"aliases":["DEBIAN-CVE-2026-72353","GHSA-7mwr-cgqq-xj42","UBUNTU-CVE-2026-72353"],"analysis":{"component_type":"kernel","fix_type":"patch","impacts":["code_execution","privilege_escalation"],"network_reachable":"yes","non_default_config":false,"product_category":"Linux kernel NTFS","requires_auth":"low_privilege","summary":"A use-after-free vulnerability in the Linux kernel NTFS driver allows local attackers to execute arbitrary code or escalate privileges via race conditions in fallocate.","user_interaction":"not_required","vuln_class":"use_after_free"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"Linux","cpe":[],"cvss":{"score":8.8,"severity":"high","source":"cna","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"cwes":[],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\nntfs: avoid stale runlist element dereference in fallocate\n\nntfs_attr_fallocate() allocates holes and delayed allocations inside\ninitialized size by looking up the current runlist element under\nni-\u003erunlist.lock. The returned struct runlist_element is only a borrowed\npointer into ni-\u003erunlist.rl. A writer can replace and free that array\nafter the read lock is dropped, so later reads of rl-\u003elcn, rl-\u003elength and\nrl-\u003evcn can touch freed memory.\n\nThe buggy scenario involves two paths, with each column showing the order\nwithin that path:\n\nntfs_attr_fallocate():\n  1. Take ni-\u003erunlist.lock for read.\n  2. Get rl from ntfs_attr_find_vcn_nolock().\n  3. Drop ni-\u003erunlist.lock.\n  4. Read rl-\u003elcn, rl-\u003elength and rl-\u003evcn.\n\nmmap page_mkwrite:\n  1. Enter ntfs_filemap_page_mkwrite().\n  2. Reach __ntfs_write_iomap_begin() and ntfs_attr_map_cluster().\n  3. Merge allocation state with ntfs_runlists_merge().\n  4. Reallocate ni-\u003erunlist.rl in ntfs_rl_realloc(), freeing the old array.\n\nValidation reproduced this kernel report:\nBUG: KASAN: slab-use-after-free in ntfs_attr_fallocate+0xbb8/0xd00\n\nCall Trace:\n \u003cTASK\u003e\n dump_stack_lvl+0x66/0xa0\n print_report+0xce/0x630\n ? ntfs_attr_fallocate+0xbb8/0xd00\n ? srso_alias_return_thunk+0x5/0xfbef5\n ? __virt_addr_valid+0x20d/0x410\n ? ntfs_attr_fallocate+0xbb8/0xd00\n kasan_report+0xe0/0x110\n ? ntfs_attr_fallocate+0xbb8/0xd00\n ntfs_attr_fallocate+0xbb8/0xd00\n ? lock_acquire+0x2b8/0x2f0\n ? __pfx_ntfs_attr_fallocate+0x10/0x10\n ? 0xffffffffc0000095\n ? down_write+0x10d/0x1e0\n ntfs_fallocate+0x5c9/0x1d00\n ? __pfx_ntfs_fallocate+0x10/0x10\n ? srso_alias_return_thunk+0x5/0xfbef5\n ? lock_acquire+0x2b8/0x2f0\n ? srso_alias_return_thunk+0x5/0xfbef5\n ? selinux_file_permission+0x3a7/0x510\n vfs_fallocate+0x29d/0xd30\n __x64_sys_fallocate+0xc7/0x150\n ? do_syscall_64+0x81/0x6a0\n do_syscall_64+0x115/0x6a0\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nAllocated by task 410:\n kasan_save_stack+0x33/0x60\n kasan_save_track+0x14/0x30\n __kasan_kmalloc+0xaa/0xb0\n __kvmalloc_node_noprof+0x353/0x920\n ntfs_rl_realloc+0x3f/0x110\n ntfs_runlists_merge+0xaa3/0x3010\n ntfs_attr_map_cluster+0x4e5/0xf80\n ntfs_attr_fallocate+0x53f/0xd00\n ntfs_fallocate+0x5c9/0x1d00\n vfs_fallocate+0x29d/0xd30\n __x64_sys_fallocate+0xc7/0x150\n do_syscall_64+0x115/0x6a0\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nFreed by task 424:\n kasan_save_stack+0x33/0x60\n kasan_save_track+0x14/0x30\n kasan_save_free_info+0x3b/0x60\n __kasan_slab_free+0x5f/0x80\n kfree+0x307/0x580\n ntfs_rl_realloc+0x6f/0x110\n ntfs_runlists_merge+0x7b1/0x3010\n ntfs_attr_map_cluster+0x4e5/0xf80\n __ntfs_write_iomap_begin+0x8cd/0x2280\n iomap_iter+0x6de/0x11e0\n iomap_page_mkwrite+0x391/0x650\n ntfs_filemap_page_mkwrite+0x1ac/0x400\n do_page_mkwrite+0x15c/0x280\n __handle_mm_fault+0xd6d/0x1ca0\n handle_mm_fault+0x19c/0x470\n do_user_addr_fault+0x23b/0x9c0\n exc_page_fault+0x5c/0xc0\n asm_exc_page_fault+0x26/0x30\n\nFix this by copying the needed runlist fields while the read lock is still\nheld and using only those scalar snapshots after unlocking.\n\nAfter the snapshot, ntfs_attr_map_cluster() can also find that the range\nis already mapped and return balloc=false. Only call ntfs_dio_zero_range()\nwhen new clusters were allocated, matching the write iomap path and\npreserving the zero-newly-allocated-holes behavior.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"ntfs: avoid stale runlist element dereference in fallocate","id":"CVE-2026-72353","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"use_after_free","year":"2026"},"n_packages":0,"n_references":2,"next":{"headline":"ntfs: avoid stale runlist element dereference in MFT writeback","id":"CVE-2026-72354"},"packages":[],"prev":{"headline":"HID: bpf: Fix hid_bpf_get_data() range check","id":"CVE-2026-72352"},"products":["Linux"],"published":"2026-08-15","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":"PUBLISHED","updated":"2026-08-17","vendors":["Linux"]},"summary":"A use-after-free vulnerability in the Linux kernel NTFS driver allows local attackers to execute arbitrary code or escalate privileges via race conditions in fallocate.","url":"https://insights.sbomify.com/CVE-2026-72353/"}