CVE-2026-72190
In the Linux kernel, the following vulnerability has been resolved: ntfs: fix mrec_lock ABBA deadlock in rename ntfs_file_fsync(), ntfs_dir_fsync() and __ntfs_write_inode() lock an inode's mrec_lock before taking the mrec_lock of its parent directory. ntfs_rename() takes old_ni->mrec_lock and old_dir_ni->mrec_lock before taking new_ni->mrec_lock for an existing target, or new_dir_ni->mrec_lock for a cross-directory rename. This can deadlock when ntfs_file_fsync() or __ntfs_write_inode() holds the target inode, or when ntfs_dir_fsync() holds a child target directory, while rename() holds the parent directory and waits for the target. Fix this by locking the existing target inode before taking any parent directory mrec_lock. For cross-directory renames where the target parent is a descendant of the source parent, lock the target parent before the source parent so the directory order matches the child-to-parent order used by ntfs_file_fsync(), ntfs_dir_fsync(), and __ntfs_write_inode().
Affected versions
Linux kernel versions
7.1
and later are affected. Fixed in
7.1.5,
7.2
and their respective stable series.
References
2 totalFrequently asked questions
-
What is CVE-2026-72190?
CVE-2026-72190 is a unscored severity Linux kernel vulnerability . It affects Linux kernel versions from 7.1 onward and has been patched in 7.1.5 and 7.2. CVE-2026-72190 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.
-
Is there a patch available for CVE-2026-72190?
Yes. CVE-2026-72190 has been patched. Fixed versions include 7.1.5 and 7.2. If you are running Linux kernel 7.1 or later up to the fix versions, apply the relevant patch for your kernel branch.
-
Is CVE-2026-72190 actively exploited?
No. CVE-2026-72190 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.