CVE-2026-72189: ntfs: fail attrlist updates when the superblock is inactive
In the Linux kernel, the following vulnerability has been resolved:
ntfs: fail attrlist updates when the superblock is inactive
genericshutdownsuper() clears SBACTIVE before evicting cached inodes. If eviction selects the fake inode for a base inode's unnamed $ATTRIBUTELIST attribute, ntfsevictbiginode() drops the fake inode's reference on the base inode while the fake inode is still hashed and marked IFREEING.
That iput can synchronously write back the base inode. The writeback path may update mapping pairs and call ntfsattrlistupdate(), which unconditionally calls ntfsattriget() for the same $ATTRIBUTELIST fake inode. VFS then finds the IFREEING inode and waits for eviction to finish, but the current task is still inside that eviction path, causing a self-deadlock in findinode().
Fix this by mirroring the teardown guard used by ntfswriteinode(): once SBACTIVE has been cleared, do not try to iget the attribute-list fake inode. Return -EIO so teardown aborts the update instead of waiting on the inode it is evicting.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
In the NTFS superblock shutdown path (generic_shutdown_super()), clear SB_ACTIVE before evicting cached inodes so the writeback/iget flow does not attempt ntfs_attr_iget() on the base inode while the fake inode is still hashed and marked self-deadlock in find_inode().
Linux kernel (NTFS) SB_ACTIVE handling during generic shutdown = clears SB_ACTIVE before evicting cached inodes - Configuration
When eviction selects the fake inode for a base inode's unnamed inode (attribute-list/ATTRIBUTE_LIST update path), return -EIO so teardown aborts the update instead of waiting on an iput that can synchronously write back the base inode.
Linux kernel (NTFS) Return code for ntfs teardown during eviction of fake inode = return -EIO
Event History
Frequently Asked Questions
What is the severity of CVE-2026-72189?
CVE-2026-72189 has been assigned a risk level of 24, indicating a significant vulnerability.
How do I fix CVE-2026-72189?
To mitigate CVE-2026-72189, ensure that your Linux kernel is updated to the latest version where the vulnerability is resolved.
What systems are affected by CVE-2026-72189?
CVE-2026-72189 affects versions of the Linux kernel that utilize NTFS file systems.
What is the impact of CVE-2026-72189?
The impact of CVE-2026-72189 involves potential failures in attribute list updates when the superblock is inactive.
When was CVE-2026-72189 published?
CVE-2026-72189 was published on August 15, 2026.