CVE-2026-72205
In the Linux kernel, the following vulnerability has been resolved:
ntfs: free volume-wide resources on fill_super failure
ntfs_fill_super()'s err_out_now path frees only the volume struct via kfree(vol), leaving several vol-owned allocations behind on every mount failure:
Because the failure paths never call ntfs_volume_free() and never reach the d_make_root() inline cleanup block (it sits above the label and is jumped over by the load_system_files() / kvmalloc failure gotos), these resources accumulate per failed mount attempt with no chance of recovery short of unloading the module.
Read full descriptionShow less
This is a silent leak: the inodes loaded prior to failure remain hashed but generic_shutdown_super() skips evict_inodes() when sb->s_root is unset, so no CHECK_DATA_CORRUPTION warning is emitted either.
Move the per-volume frees down to err_out_now and drop the lcn_empty_bits_per_page kvfree() from the upper label so the cleanup is performed exactly once on every failure path. Using unconditional kvfree() / kfree() / unload_nls() is safe because they all accept NULL and the upper labels that previously freed nls_map (the d_make_root() inline cleanup) already clear the pointer.
Technical details traces, logs and code from the original report
- vol->nls_map, loaded by ntfs_init_fs_context() via
load_nls_default() (or replaced by an explicit nls= option in
ntfs_parse_param()), is never unload_nls()'d.
- vol->volume_label, allocated by load_system_files() through
ntfs_ucstonls() once the $Volume name attribute has been parsed, is
not released by load_system_files()'s own error labels nor by the
fill_super() inline cleanup that only runs on d_make_root()
failure. Any later failure inside load_system_files() leaks it.
- vol->lcn_empty_bits_per_page was kvfree()'d in
unl_upcase_iput_tmp_ino_err_out_now without clearing the pointer,
so it could not be folded into a single common cleanup.CVSS
NVD hasn't assigned a CVSS score to this CVE (common since the April 2026 policy change).
Exploitation probability (EPSS)
- Probability of exploitation in the next 30 days: 0.20%
- Percentile among all scored CVEs: 9
- Score date: 10/4/2026
EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).
Affected technologies (1)
⚠ AI-inferred from the description — NVD hasn't analyzed this CVE yet, these aren't verified CPEs.
References
Raw JSON (NVD)
Show
{
"id": "CVE-2026-72205",
"cveTags": [],
"metrics": {},
"affected": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"affectedData": [
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "6251f0b0de7d645e3591931ca4c11d8322c1866f",
"lessThan": "aca3d383a23cb7f3a2849c09fda3974f1838d941",
"versionType": "git"
},
{
"status": "affected",
"version": "6251f0b0de7d645e3591931ca4c11d8322c1866f",
"lessThan": "a9523a7d3b24b3a6b25ec1eb668ee6618cacf05e",
"versionType": "git"
}
],
"programFiles": [
"fs/ntfs/super.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "7.1"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "7.1",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver",
"lessThanOrEqual": "7.1.*"
},
{
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"fs/ntfs/super.c"
],
"defaultStatus": "affected"
}
]
}
],
"published": "2026-08-15T06:21:39.190",
"references": [
{
"url": "https://git.kernel.org/stable/c/a9523a7d3b24b3a6b25ec1eb668ee6618cacf05e",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/aca3d383a23cb7f3a2849c09fda3974f1838d941",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
],
"vulnStatus": "Received",
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nntfs: free volume-wide resources on fill_super failure\n\nntfs_fill_super()'s err_out_now path frees only the volume struct via\nkfree(vol), leaving several vol-owned allocations behind on every mount\nfailure:\n\n - vol->nls_map, loaded by ntfs_init_fs_context() via\n load_nls_default() (or replaced by an explicit nls= option in\n ntfs_parse_param()), is never unload_nls()'d.\n\n - vol->volume_label, allocated by load_system_files() through\n ntfs_ucstonls() once the $Volume name attribute has been parsed, is\n not released by load_system_files()'s own error labels nor by the\n fill_super() inline cleanup that only runs on d_make_root()\n failure. Any later failure inside load_system_files() leaks it.\n\n - vol->lcn_empty_bits_per_page was kvfree()'d in\n unl_upcase_iput_tmp_ino_err_out_now without clearing the pointer,\n so it could not be folded into a single common cleanup.\n\nBecause the failure paths never call ntfs_volume_free() and never reach\nthe d_make_root() inline cleanup block (it sits above the label and is\njumped over by the load_system_files() / kvmalloc failure gotos), these\nresources accumulate per failed mount attempt with no chance of\nrecovery short of unloading the module. This is a silent leak: the\ninodes loaded prior to failure remain hashed but generic_shutdown_super()\nskips evict_inodes() when sb->s_root is unset, so no CHECK_DATA_CORRUPTION\nwarning is emitted either.\n\nMove the per-volume frees down to err_out_now and drop the\nlcn_empty_bits_per_page kvfree() from the upper label so the cleanup is\nperformed exactly once on every failure path. Using unconditional\nkvfree() / kfree() / unload_nls() is safe because they all accept NULL\nand the upper labels that previously freed nls_map (the d_make_root()\ninline cleanup) already clear the pointer."
}
],
"lastModified": "2026-08-18T07:16:53.877",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}