CVE-2026-72189
In the Linux kernel, the following vulnerability has been resolved: ntfs: fail attrlist updates when the superblock is inactive generic_shutdown_super() clears SB_ACTIVE before evicting cached inodes. If eviction selects the fake inode for a base inode's unnamed $ATTRIBUTE_LIST attribute, ntfs_evict_big_inode() drops the fake inode's reference on the base inode while the fake inode is still hashed and marked I_FREEING. That iput can synchronously write back the base inode. The writeback path may update mapping pairs and call ntfs_attrlist_update(), which unconditionally calls ntfs_attr_iget() for the same $ATTRIBUTE_LIST fake inode. VFS then finds the I_FREEING inode and waits for eviction to finish, but the current task is still inside that eviction path, causing a self-deadlock in find_inode(). Fix this by mirroring the teardown guard used by __ntfs_write_inode(): once SB_ACTIVE has been cleared, do not try to iget the attribute-list fake inode. Return -EIO so teardown aborts the update instead of waiting on the inode it is evicting.
Affected versions
Linux kernel versions
7.1
and later are affected. Fixed in
7.1.5,
7.2-rc3
and their respective stable series.
References
2 totalFrequently asked questions
-
What is CVE-2026-72189?
CVE-2026-72189 is a unscored severity Linux kernel vulnerability . It affects Linux kernel versions from 7.1 onward and has been patched in 7.1.5 and 7.2-rc3. CVE-2026-72189 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.
-
Is there a patch available for CVE-2026-72189?
Yes. CVE-2026-72189 has been patched. Fixed versions include 7.1.5 and 7.2-rc3. If you are running Linux kernel 7.1 or later up to the fix versions, apply the relevant patch for your kernel branch.
-
Is CVE-2026-72189 actively exploited?
No. CVE-2026-72189 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.