{"id":6822,"date":"2026-09-04T18:49:18","date_gmt":"2026-09-04T10:49:18","guid":{"rendered":"https:\/\/www.54iter.cn\/?vuln=cve-2026-72188"},"modified":"2026-09-04T18:49:18","modified_gmt":"2026-09-04T10:49:18","slug":"cve-2026-72188","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-72188","title":{"rendered":"CVE-2026-72188 [CRITICAL] &#8211; In the Linux kernel, the following vulnerability has been resolved:\n\nntfs: sanitize MFT re"},"content":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>ntfs: sanitize MFT references returned from ntfs_lookup_inode_by_name()<\/p>\n<p>ntfs_lookup_inode_by_name() returns MFT references read from directory<br \/>\nindex entries on disk. These values are untrusted, but the function can<br \/>\ncurrently return an error-marked MFT reference to its callers without<br \/>\nvalidating it.<\/p>\n<p>Callers later decode lookup failures with MREF_ERR(). A crafted NTFS image<br \/>\ncan set the MREF error bit while leaving the low bits as an arbitrary<br \/>\nvalue, causing callers to consume a bogus pseudo-errno instead of treating<br \/>\nthe lookup result as corrupted on-disk metadata.<\/p>\n<p>Fix this at the source by normalizing every error-marked MFT reference<br \/>\nreturned from ntfs_lookup_inode_by_name() to ERR_MREF(-EIO). Apply this to<br \/>\nall four directory lookup return paths so every caller gets a validated<br \/>\nresult without needing additional checks or an API change.<\/p>\n<p>This keeps the sanitization in the common lookup helper, which is cleaner<br \/>\nthan duplicating validation in each caller.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>ntfs: sanitize MFT references returned from ntfs_lookup_inode_by_name()<\/p>\n<p>ntfs_lookup_inode_by_name() returns MFT references read fr<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-6822","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/6822","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=6822"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=6822"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=6822"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}