CVE-2026-72198

This is a kernel privilege escalation vulnerability, and the low EPSS score is misleading. The EPSS model predicts network-facing exploitability; CVE-2026-72198 attacks the kernel through untrusted input — a mounted NTFS volume. That changes the threat model entirely. Removable media, shared filesystems, container volumes, and any scenario where users can present a crafted NTFS image to the kernel are the actual attack vectors. Do not deprioritize this based on the 0.00154 EPSS score alone. The vulnerability stems from a partial validation layer in the NTFS driver's attribute lookup API. A validator was introduced to reject non-resident records for $FILE_NAME and $VOLUME_NAME, with the assumption that callers would always receive resident attributes. But this protection only covered two attribute types, while other code paths — inode loading, sync functions, volume flag writing — made identical resident-only assumptions about $STANDARD_INFORMATION, $INDEX_ROOT, $VOLUME_INFORMATION, $OBJECT_ID, and $EA_INFORMATION. Each caller read the resident value offset field without verifying `a->non_resident`, trusting (incorrectly) that the validator covered them. The patch extends coverage to seven attribute types by factoring the validation through a helper function. That's the correct immediate response, but the architectural debt remains. The validator is still an ad-hoc list that grows with each CVE rather than a formal type contract enforced at compile time. Future developers adding new attribute types to this API will face the same pressure: add an entry to the list, or risk another vulnerability. Practical guidance: apply the kernel patch immediately, particularly on systems handling untrusted NTFS volumes. If you're maintaining NTFS driver code or auditing similar filesystem drivers, treat this as a signal to search for patterns where callers assume resident-only behavior without explicit type-level enforcement. The blast radius of a malformed volume runs through inode load into every downstream operation — this isn't a theoretical risk, it's a trust boundary violation with kernel-level consequences.

Reviewed through automated stages and approved by a human before publication.