CVE-2026-72206

CVE-2026-72206 is a kernel memory corruption flaw in the NTFS3 driver's INDEX_HEADER geometry validation. The patch adds stricter checks to structures that were already validated but incompletely—so the old code passed format-sane headers that triggered downstream memory inconsistencies. This is the same failure mode seen in ext4 dx_node patches (2019) and btrfs index root header patches (2020-2022): validation existed but checked what developers thought mattered rather than what attackers actually probe. The 9.8 CVSS is technically correct—kernel memory corruption is as severe as it gets. The 0.00516 EPSS is also correct, but the gap between them isn't a scoring anomaly; it's a structural blind spot. This vulnerability requires mounting a malicious NTFS volume to trigger. That's not an external attack surface—it's an escalation path activated after an attacker already controls the image layer: a tampered container image, a compromised VM disk, a malicious ISO, or a crafted USB device. The EPSS measures external exploitation probability; it doesn't measure damage conditional on a foothold already existing. What matters for defenders: this is a force multiplier, not a beachhead. If an attacker already has arbitrary write to container images, VM disks, or can insert malicious removable media, this becomes the kernel-mediated amplification that converts filesystem access into ring-zero code execution. Your priority isn't blocking external attackers from triggering it—it's ensuring the image integrity chain (container registries, VM templates, ISO provenance) is solid enough that attackers can't inject malicious NTFS structures in the first place. The vulnerability is low-priority for CVE databases but high-priority for post-breach hardening. Patch it, but treat the CVSS score as maximum theoretical impact and the EPSS as external actor probability—not as indicators of actual reachability in your environment.

Reviewed through automated stages and approved by a human before publication.