{
  "cveId": "CVE-2026-72354",
  "url": "https://patchblox.com/security/cve/CVE-2026-72354",
  "summary": "CVE-2026-72354 is fixed in linux on 1 platform by DEBIAN-CVE-2026-72354 (version 7.1.5-1), released August 15, 2026. It is not reported as exploited. Patch Radar priority: High.",
  "title": "linux: In the Linux kernel, the following vulnerability has been resolved:  ntfs: avoid stale runlist element dereference in...",
  "description": "In the Linux kernel, the following vulnerability has been resolved:  ntfs: avoid stale runlist element dereference in MFT writeback  ntfs_write_mft_block() maps each $MFT record through the $MFT data runlist. For sub-folio clusters it looks up a struct runlist_element under ni-\u003Erunlist.lock, drops the lock, and later uses rl-\u003Elength and rl-\u003Evcn when choosing folio_sz.  That pointer is only borrowed from ni-\u003Erunlist.rl. Concurrent $MFT allocation extension can merge a replacement runlist under the same lock, and ntfs_rl_realloc() can free the old backing array. If that happens between the lookup and the later folio_sz decision, writeback can dereference freed runlist storage.  The buggy scenario involves two paths, with each column showing the order within that path:  MFT writeback path:               $MFT allocation extension: 1. Look up rl under               1. Extend the $MFT data allocation.    ni-\u003Erunlist.lock.              2. Publish a replacement runlist. 2. Drop ni-\u003Erunlist.lock.         3. Free the old runlist array. 3. Read rl-\u003Elength and rl-\u003Evcn    to choose folio_sz.  Compute the remaining run length while ni-\u003Erunlist.lock is still held, and use that scalar after unlock. This preserves the existing folio sizing decision without carrying a borrowed runlist_element across the lock boundary.  Validation reproduced this kernel report: BUG: KASAN: slab-use-after-free in ntfs_mft_writepages\u002B0x1c8d/0x1fb0  Call Trace:  \u003CTASK\u003E  dump_stack_lvl\u002B0x66/0xa0  print_report\u002B0xce/0x630  ? ntfs_mft_writepages\u002B0x1c8d/0x1fb0  ? srso_alias_return_thunk\u002B0x5/0xfbef5  ? __virt_addr_valid\u002B0x20d/0x410  ? ntfs_mft_writepages\u002B0x1c8d/0x1fb0  kasan_report\u002B0xe0/0x110  ? ntfs_mft_writepages\u002B0x1c8d/0x1fb0  ntfs_mft_writepages\u002B0x1c8d/0x1fb0  ? __pfx_ntfs_mft_writepages\u002B0x10/0x10  ? __pfx___mutex_unlock_slowpath\u002B0x10/0x10  ? srso_alias_return_thunk\u002B0x5/0xfbef5  ? iput\u002B0x92/0xa80  do_writepages\u002B0x219/0x530  ? __pfx_do_writepages\u002B0x10/0x10  __writeback_single_inode\u002B0x117/0xf50  ? do_raw_spin_lock\u002B0x130/0x270  ? __pfx_do_raw_spin_lock\u002B0x10/0x10  ? __pfx___writeback_single_inode\u002B0x10/0x10  ? srso_alias_return_thunk\u002B0x5/0xfbef5  writeback_sb_inodes\u002B0x65b/0x1810  ? srso_alias_return_thunk\u002B0x5/0xfbef5  ? lock_acquire\u002B0x2b8/0x2f0  ? __pfx_writeback_sb_inodes\u002B0x10/0x10  ? lock_release\u002B0x1e0/0x280  ? _raw_spin_unlock\u002B0x23/0x40  ? move_expired_inodes\u002B0x2b8/0x850  __writeback_inodes_wb\u002B0xf4/0x270  ? __pfx___writeback_inodes_wb\u002B0x10/0x10  ? srso_alias_return_thunk\u002B0x5/0xfbef5  ? queue_io\u002B0x2e4/0x410  wb_writeback\u002B0x666/0x880  ? srso_alias_return_thunk\u002B0x5/0xfbef5  ? __pfx_wb_writeback\u002B0x10/0x10  ? srso_alias_return_thunk\u002B0x5/0xfbef5  ? srso_alias_return_thunk\u002B0x5/0xfbef5  ? get_nr_dirty_inodes\u002B0x1c/0x170  wb_workfn\u002B0x75e/0xbb0  ? srso_alias_return_thunk\u002B0x5/0xfbef5  ? _raw_spin_unlock_irqrestore\u002B0x27/0x60  ? __pfx_wb_workfn\u002B0x10/0x10  ? __pfx_debug_object_deactivate\u002B0x10/0x10  ? lock_acquire\u002B0x2b8/0x2f0  ? srso_alias_return_thunk\u002B0x5/0xfbef5  ? lock_release\u002B0x1e0/0x280  process_one_work\u002B0x8d0/0x1870  ? __pfx_process_one_work\u002B0x10/0x10  ? srso_alias_return_thunk\u002B0x5/0xfbef5  worker_thread\u002B0x575/0xf80  ? __pfx_worker_thread\u002B0x10/0x10  kthread\u002B0x2e7/0x3c0  ? __pfx_kthread\u002B0x10/0x10  ret_from_fork\u002B0x576/0x810  ? __pfx_ret_from_fork\u002B0x10/0x10  ? srso_alias_return_thunk\u002B0x5/0xfbef5  ? __switch_to\u002B0x57e/0xe10  ? __switch_to_asm\u002B0x33/0x70  ? __pfx_kthread\u002B0x10/0x10  ret_from_fork_asm\u002B0x1a/0x30  \u003C/TASK\u003E  Allocated by task 970:  kasan_save_stack\u002B0x33/0x60  kasan_save_track\u002B0x14/0x30  __kasan_kmalloc\u002B0xaa/0xb0  __kvmalloc_node_noprof\u002B0x353/0x920  ntfs_rl_realloc\u002B0x3c/0x80  ntfs_runlists_merge\u002B0x1212/0x3010  ntfs_mft_data_extend_allocation_nolock\u002B0x3e0/0x1f40  ntfs_mft_record_alloc\u002B0x1ab4/0x4f10  __ntfs_create\u002B0x680/0x2e50  ntfs_create\u002B0x1e6/0x3a0  path_openat\u002B0x2b55/0x3c10  do_file_open\u002B0x1f4/0x460  do_sys_openat2\u002B0xde/0x170  __x64_sys_openat\u002B0x122/0x1e0  do_syscall_64\u002B0x115/0x6a0  entry_SYSCALL_64_after_hwframe\u002B0x77/0x7f  Freed by task 1294:  kasan_save_ ---truncated---",
  "published": "2026-08-15T06:22:08Z",
  "severity": "high",
  "cvss": 8.8,
  "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
  "epss": 0.00508,
  "epssPercentile": 0.43652,
  "priority": "High",
  "priorityTier": 3,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 14",
      "fixedVersion": "7.1.5-1",
      "fix": "DEBIAN-CVE-2026-72354",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-72354",
      "released": "2026-08-15T22:38:55Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-09T13:31:49Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}