{"id":"CVE-2026-72188","summary":"ntfs: sanitize MFT references returned from ntfs_lookup_inode_by_name()","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nntfs: sanitize MFT references returned from ntfs_lookup_inode_by_name()\n\nntfs_lookup_inode_by_name() returns MFT references read from directory\nindex entries on disk. These values are untrusted, but the function can\ncurrently return an error-marked MFT reference to its callers without\nvalidating it.\n\nCallers later decode lookup failures with MREF_ERR(). A crafted NTFS image\ncan set the MREF error bit while leaving the low bits as an arbitrary\nvalue, causing callers to consume a bogus pseudo-errno instead of treating\nthe lookup result as corrupted on-disk metadata.\n\nFix this at the source by normalizing every error-marked MFT reference\nreturned from ntfs_lookup_inode_by_name() to ERR_MREF(-EIO). Apply this to\nall four directory lookup return paths so every caller gets a validated\nresult without needing additional checks or an API change.\n\nThis keeps the sanitization in the common lookup helper, which is cleaner\nthan duplicating validation in each caller.","modified":"2026-08-16T03:48:33.912084343Z","published":"2026-08-15T05:53:49.593Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/72xxx/CVE-2026-72188.json","cna_assigner":"Linux"},"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/83f396d881c4fd312c7fd5fff2c157fc21104464"},{"type":"WEB","url":"https://git.kernel.org/stable/c/d97a36bae86a9a4021562ded2987f904e6bcb1d7"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/72xxx/CVE-2026-72188.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-72188"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"1e9ea7e04472d4e5e12e58c881eaacfb3e49b669"},{"fixed":"83f396d881c4fd312c7fd5fff2c157fc21104464"},{"fixed":"d97a36bae86a9a4021562ded2987f904e6bcb1d7"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-72188.json"}},{"package":{"name":"Kernel","ecosystem":"Linux"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.1.0"},{"fixed":"7.1.5"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-72188.json"}}],"schema_version":"1.9.0"}