{
  "cveId": "CVE-2026-72203",
  "url": "https://patchblox.com/security/cve/CVE-2026-72203",
  "summary": "CVE-2026-72203 is fixed in linux on 1 platform by DEBIAN-CVE-2026-72203 (version 7.1.5-1), released August 15, 2026. It is not reported as exploited. Patch Radar priority: High.",
  "title": "ntfs: skip extent mft records in writeback to prevent deadlock",
  "description": "In the Linux kernel, the following vulnerability has been resolved:  ntfs: skip extent mft records in writeback to prevent deadlock  This patch fixes the ABBA deadlock between extent_lock and extent mrec_lock triggered by xfstests generic/113, that occurs since the commit 6994acf33bae (\u0022ntfs: use base mft_no when looking up base inode for \t\textent record\u0022).  Path A (inode writeback):   VFS writeback     -\u003E ntfs_write_inode()       -\u003E __ntfs_write_inode()         -\u003E mutex_lock(\u0026ni-\u003Eextent_lock)         -\u003E mutex_lock(\u0026tni-\u003Emrec_lock)  Path B (MFT folio writeback):   VFS writeback of $MFT dirty folios     -\u003E ntfs_mft_writepages()       -\u003E ntfs_write_mft_block()         -\u003E ntfs_may_write_mft_record()           -\u003E holds one extent mrec_lock from a previous iteration           -\u003E tries to acquire another base inode extent_lock  By removing all extent_lock and extent mrec_lock acquisition from the MFT folio writeback path, the ABBA lock ordering is eliminated:  Path A: __ntfs_write_inode(): extent_lock -\u003E mrec_lock Path B (removed): ntfs_write_mft_block(): mrec_lock -\u003E extent_lock  Path B is always redundant for extent records because:  1. mark_mft_record_dirty(ext_ni) does NOT dirty the MFT folio.    It only sets NInoDirty(ext_ni) and marks the base VFS inode dirty    via __mark_inode_dirty(I_DIRTY_DATASYNC), which triggers Path A.    Therefore, normal extent modifications never create a situation where    the MFT folio is dirty and Path B is not scheduled.  2. The MFT folio only gets dirtied via ntfs_mft_mark_dirty() inside    ntfs_mft_record_alloc(). But all identified callers in attrib.c    (ntfs_attr_add, ntfs_attr_record_move_away,    ntfs_attr_make_non_resident, ntfs_attr_record_resize) follow through    with mark_mft_record_dirty(), which triggers Path A to write the    complete record.  3. ntfs_evict_big_inode() calls ntfs_commit_inode() before freeing extent    inodes, ensuring all dirty extents are flushed via Path A before the    base inode leaves the icache.",
  "published": "2026-08-15T06:21:38Z",
  "severity": "Moderate",
  "cvss": 7.5,
  "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
  "epss": 0.0063,
  "epssPercentile": 0.5043,
  "priority": "High",
  "priorityTier": 3,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "vendorAdvisory": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-72203",
  "fixes": [
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 14",
      "fixedVersion": "7.1.5-1",
      "fix": "DEBIAN-CVE-2026-72203",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-72203",
      "released": "2026-08-15T22:38:55Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T13:06:02Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}