CVE-2026-72190: ntfs: fix mrec_lock ABBA deadlock in rename
In the Linux kernel, the following vulnerability has been resolved:
ntfs: fix mreclock ABBA deadlock in rename
ntfsfilefsync(), ntfsdirfsync() and ntfswriteinode() lock an inode's mreclock before taking the mreclock of its parent directory.
ntfsrename() takes oldni->mreclock and olddirni->mreclock before taking newni->mreclock for an existing target, or newdirni->mreclock for a cross-directory rename. This can deadlock when ntfsfilefsync() or ntfswriteinode() holds the target inode, or when ntfsdirfsync() holds a child target directory, while rename() holds the parent directory and waits for the target.
Fix this by locking the existing target inode before taking any parent directory mreclock. For cross-directory renames where the target parent is a descendant of the source parent, lock the target parent before the source parent so the directory order matches the child-to-parent order used by ntfsfilefsync(), ntfsdirfsync(), and ntfswriteinode().
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-72190?
CVE-2026-72190 has a risk rating of 17, indicating a significant level of concern.
How does CVE-2026-72190 affect the Linux kernel?
CVE-2026-72190 addresses an ABBA deadlock issue in the NTFS file system of the Linux kernel.
What is the root cause of CVE-2026-72190?
The vulnerability is caused by inadequate locking order when renaming files and directories in NTFS.
How do I mitigate CVE-2026-72190?
To mitigate CVE-2026-72190, ensure that you upgrade to a patched version of the Linux kernel.
What are the potential impacts of CVE-2026-72190 if left unpatched?
If CVE-2026-72190 is left unpatched, it may lead to system hangs and application crashes due to deadlock.