CVE-2026-72477

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: call _ntfs_bad_inode() when failing to rename It is safe to call _ntfs_bad_inode on live inodes since: commit 519b078998ce ("fs/ntfs3: Exclude call make_bad_inode for live nodes.") The WARN_ON was added when it wasn't safe by: commit d99208b91933 ("fs/ntfs3: cancle set bad inode after removing name fails") Replace the WARN_ON with a call to _ntfs_bad_inode() to prevent further operations on the inconsistent inode.

Package Linux Kernel
Published 2026-08-15
Last modified 2026-08-15
Patch available
Yes

Affected versions

Linux kernel versions 6.17 and later are affected. Fixed in 7.1.5, 7.2-rc1 and their respective stable series.

Affected from
≥ 6.17
Fixed in
✓ 7.1.5 7.1.x ✓ 7.2-rc1

References

2 total

Frequently asked questions

  • What is CVE-2026-72477?

    CVE-2026-72477 is a unscored severity Linux kernel vulnerability . It affects Linux kernel versions from 6.17 onward and has been patched in 7.1.5 and 7.2-rc1. CVE-2026-72477 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.

  • Is there a patch available for CVE-2026-72477?

    Yes. CVE-2026-72477 has been patched. Fixed versions include 7.1.5 and 7.2-rc1. If you are running Linux kernel 6.17 or later up to the fix versions, apply the relevant patch for your kernel branch.

  • Is CVE-2026-72477 actively exploited?

    No. CVE-2026-72477 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

Back to
All CVEs
View on
NVD / NIST