Critical Vulnerability: CVE-2026-72199

In the Linux kernel, the following vulnerability has been resolved:

ntfs: validate resident index root values on lookup

Resident $INDEX_ROOT values carry index header fields that callers

consume after lookup. Some callers already validate parts of the layout

before walking entries, but those checks are scattered and do not cover

all root header invariants, such as entries_offset alignment and lower

bound, index_length, and allocated_size consistency.

The resident root resize paths now keep these header fields consistent

while the value size changes: ntfs_ir_truncate() lowers

index.allocated_size before shrinking the resident value, and

ntfs_ir_reparent() grows the resident value before publishing a larger

root header. Lookup-time validation can therefore cover these invariants

without tripping over the driver's own resize paths.

Add $INDEX_ROOT to the minimum resident value size table and validate the

resident index header fields before returning the attribute from lookup.

Require

CVE-2026-72199 is rated CRITICAL severity, requiring immediate attention from security teams.

CVSS Base Score: 9.8/10

EPSS (Exploit Prediction): 0.5% probability of exploitation in the next 30 days.

Use Vulnios to continuously monitor your exposure to CVE-2026-72199 and similar vulnerabilities.

Vulnios scans for this vulnerability using Trivy and Grype for SBOM-based CVE matching and Vulnios CVE feed continuous monitoring against your asset inventory. Run a scan against your environment to see whether you are exposed; findings are linked back to the original CVE record so triage starts with the patch path already known.