CVE-2026-72189

In the Linux kernel, the following vulnerability has been resolved: ntfs: fail attrlist updates when the superblock is inactive generic_shutdown_super() clears SB_ACTIVE before evicting cached inodes. If eviction selects the fake inode for a base inode's unnamed $ATTRIBUTE_LIST attribute, ntfs_evict_big_inode() drops the fake inode's reference on the base inode while the fake inode is still hashed and marked I_FREEING. That iput can synchronously write back the base inode. The writeback path may update mapping pairs and call ntfs_attrlist_update(), which unconditionally calls ntfs_attr_iget() for the same $ATTRIBUTE_LIST fake inode. VFS then finds the I_FREEING inode and waits for eviction to finish, but the current task is still inside that eviction path, causing a self-deadlock in find_inode(). Fix this by mirroring the teardown guard used by __ntfs_write_inode(): once SB_ACTIVE has been cleared, do not try to iget the attribute-list fake inode. Return -EIO so teardown aborts the update instead of waiting on the inode it is evicting.

Package Linux Kernel
Published 2026-08-15
Last modified 2026-08-15
Patch available
Yes

Affected versions

Linux kernel versions 7.1 and later are affected. Fixed in 7.1.5, 7.2-rc3 and their respective stable series.

Affected from
≥ 7.1
Fixed in
✓ 7.1.5 7.1.x ✓ 7.2-rc3

Frequently asked questions

  • What is CVE-2026-72189?

    CVE-2026-72189 is a unscored severity Linux kernel vulnerability . It affects Linux kernel versions from 7.1 onward and has been patched in 7.1.5 and 7.2-rc3. CVE-2026-72189 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.

  • Is there a patch available for CVE-2026-72189?

    Yes. CVE-2026-72189 has been patched. Fixed versions include 7.1.5 and 7.2-rc3. If you are running Linux kernel 7.1 or later up to the fix versions, apply the relevant patch for your kernel branch.

  • Is CVE-2026-72189 actively exploited?

    No. CVE-2026-72189 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.