CVE-2026-72203

The CVSS 7.5 rating for this NTFS deadlock bug is misleading—not because the bug is unimportant, but because it measures the wrong axis entirely. The vulnerability manifests as an ABBA deadlock between inode and MFT extent locks, discovered by xfstests generic/113 under pathological writeback concurrency. The EPSS score of 0.00468 reflects the difficulty of triggering this condition in practice, which is accurate. But the real risk isn't the deadlock. What happens when Path A and Path B execute concurrently with the invariant violated isn't a recoverable deadlock you can diagnose and recover from—it's silent MFT extent record corruption. The lock ordering that existed before this patch enforced serialization of extent record commits through the base inode's writeback path. The patch removes that guarantee by arguing that all callers triggering Path B also trigger Path A, making the extent lock acquisition redundant. When that trust breaks—during an unexpected recovery path, journal replay with partial writes, or a future NTFS caller that doesn't follow the attributed.c pattern—you don't deadlock. You corrupt the very structure that maps which blocks belong to which files. NTFS lacks fsck-style recovery for this. The blast radius scales with the number of files in the affected extent range. The fix trades a visible, recoverable failure mode for an invisible, cascading one. The deadlock was a forcing function—it made problems observable. The patch eliminates that symptom without eliminating the underlying coupling. The behavioral invariants the patch relies on (that mark_mft_record_dirty() always redirects through the correct lock sequence, that all folio-dirtying callers also trigger the base inode dirty path, that eviction always commits before freeing) are documented only in the commit message, not in code, not enforced by lockdep, not checked at runtime. These are archaeological invariants—visible to whoever reads the commit history, invisible to anyone maintaining the driver five years from now. The practical implications: apply the patch, but treat the underlying locking protocol as technical debt. Add lockdep annotations to explicitly document why Path B is semantically redundant. Extend testing beyond xfstests to cover recovery paths and journal replay scenarios that don't exercise the four known attributed.c callers. The CVSS severity understates the corruption risk while overstating exploitability—the opposite of what defenders should prioritize. Your monitoring should watch for NTFS metadata corruption indicators in systems with sustained writeback pressure, not just deadlock symptoms.

Reviewed through automated stages and approved by a human before publication.