CVE-2026-72199

CVE-2026-72199 in the Linux NTFS driver is best understood as a validation architecture failure rather than a single missing check. The vulnerability required coordinated fixes across three distinct components — truncation logic, reparenting logic, and the lookup path itself — precisely because validation was diffusely implemented across callers rather than enforced at a single consumption point. The scatter created seams that eventually cracked: entries_offset alignment, index_length boundaries, and allocated_size consistency were each checked in isolation by different callers, but no location held the complete invariant set. The 8-byte alignment requirement is the specific constraint that likely prevented prior validation attempts from succeeding. This wasn't an obscure invariant that fell through the cracks — it was a known performance boundary that the driver itself was violating during its own resize paths. The commit message effectively confesses this: lookup-time validation was added only after resize paths were made self-consistent, explicitly because the driver couldn't risk tripping over its own invalid outputs. That sequence reveals the real problem — the NTFS driver had been generating metadata states internally that lookup validation would reject, surviving only because no defensive layer existed at the consumption point. The EPSS score of 0.00516 against a 9.8 CVSS reflects the specific deployment context: NTFS support in Linux serves Windows interoperability use cases rather than broad enterprise primary storage, and the affected code path (resident index roots) operates on metadata users never directly touch. But this gap should not diminish urgency for those who do use the driver — any ring-0 code execution via filesystem metadata is catastrophic in principle, and the structural pattern of scattered trust assumptions likely exists elsewhere in the driver's resident attribute handling. What to check: verify that $INDEX_ROOT validation is active in your kernel version (look for the alignment and boundary checks in the ntfs_index_lookup or equivalent path). More importantly, audit other resident attribute types — the coordinated resize-path changes that fixed $INDEX_ROOT may have exposed whether similar latent inconsistencies exist in how the driver handles other resident metadata. The architectural lesson is that the NTFS driver's threat model must now treat all metadata as potentially hostile, including metadata the driver itself generates. That is a threat model migration, not merely a patch.

Reviewed through automated stages and approved by a human before publication.