{
  "cveId": "CVE-2026-72205",
  "url": "https://patchblox.com/security/cve/CVE-2026-72205",
  "summary": "CVE-2026-72205 is fixed in linux on 1 platform by DEBIAN-CVE-2026-72205 (version 7.1.5-1), released August 15, 2026. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "linux: In the Linux kernel, the following vulnerability has been resolved:  ntfs: free volume-wide resources on fill_super f...",
  "description": "In the Linux kernel, the following vulnerability has been resolved:  ntfs: free volume-wide resources on fill_super failure  ntfs_fill_super()\u0027s err_out_now path frees only the volume struct via kfree(vol), leaving several vol-owned allocations behind on every mount failure:    - vol-\u003Enls_map, loaded by ntfs_init_fs_context() via     load_nls_default() (or replaced by an explicit nls= option in     ntfs_parse_param()), is never unload_nls()\u0027d.    - vol-\u003Evolume_label, allocated by load_system_files() through     ntfs_ucstonls() once the $Volume name attribute has been parsed, is     not released by load_system_files()\u0027s own error labels nor by the     fill_super() inline cleanup that only runs on d_make_root()     failure.  Any later failure inside load_system_files() leaks it.    - vol-\u003Elcn_empty_bits_per_page was kvfree()\u0027d in     unl_upcase_iput_tmp_ino_err_out_now without clearing the pointer,     so it could not be folded into a single common cleanup.  Because the failure paths never call ntfs_volume_free() and never reach the d_make_root() inline cleanup block (it sits above the label and is jumped over by the load_system_files() / kvmalloc failure gotos), these resources accumulate per failed mount attempt with no chance of recovery short of unloading the module.  This is a silent leak: the inodes loaded prior to failure remain hashed but generic_shutdown_super() skips evict_inodes() when sb-\u003Es_root is unset, so no CHECK_DATA_CORRUPTION warning is emitted either.  Move the per-volume frees down to err_out_now and drop the lcn_empty_bits_per_page kvfree() from the upper label so the cleanup is performed exactly once on every failure path.  Using unconditional kvfree() / kfree() / unload_nls() is safe because they all accept NULL and the upper labels that previously freed nls_map (the d_make_root() inline cleanup) already clear the pointer.",
  "published": "2026-08-15T06:21:39Z",
  "severity": "",
  "epss": 0.00198,
  "epssPercentile": 0.09581,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 14",
      "fixedVersion": "7.1.5-1",
      "fix": "DEBIAN-CVE-2026-72205",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-72205",
      "released": "2026-08-15T22:38:55Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T06:59:42Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}