CVE-2026-72194

Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source

AV:NAttack vector, network

ntfs3 registers export_operations; on NAS/hybrid servers exporting an NTFS volume via nfsd or ksmbd, a remote client's unlink reaches vfs_unlink→ntfs_unlink_inode→ni_remove_name→indx_delete_entry→indx_find_buffer without any local syscall from the attacker.

AC:LAttack complexity, low

The attacker fully controls on-disk INDEX_ENTRY VCN pointers and can craft circular B+ tree references so indx_find_buffer() recurses deterministically until stack exhaustion; no race, special heap layout, or other uncontrollable condition is required beyond presenting the image and issuing unlink.

PR:NPrivileges required, none

Exploitation requires only supplying a malicious NTFS image later mounted by root/udisks2/automount, or write permission on an NFS/SMB-exported NTFS share (including guest/anonymous write); no init-namespace root, CAP_SYS_ADMIN, or other elevated host credentials are needed on the trigger path.

UI:NUser interaction, none

Once an administrator has mounted and optionally exported the NTFS volume—or desktop/kiosk automount has attached removable media—the attacker issues unlink directly; no further victim clicks, file opens, or cooperative actions beyond that standing configuration are required.

S:UScope, unchanged

Impact is kernel stack overflow and panic within the host kernel's security authority; this is standard local or network filesystem exploitation, not a VM escape, IOMMU bypass, or cross-scope sandbox breakout.

C:HConfidentiality impact, high

Unbounded recursion overflows the kernel stack, corrupting stack memory before the guard-page fault; under overestimation guidance, kernel stack corruption is treated as potentially enabling arbitrary kernel memory disclosure or information leakage via control-data overwrite.

I:HIntegrity impact, high

Recursive stack exhaustion corrupts return addresses and adjacent stack frames on the kernel stack, plausibly enabling control-flow hijack or arbitrary kernel modification even though the immediate failure mode is a panic.

A:HAvailability impact, high

The fix commit and call path confirm unbounded recursion overflows the kernel stack and panics the system; any kernel oops, stack guard fault, or panic from this path scores Availability High.