{
  "affected": [
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:12",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.1.180-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:13",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.100-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:14",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "7.1.5-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:  ntfs3: cap RESTART_TABLE free-chain walker at rt-\u003eused  A crafted NTFS3 disk image triggers an in-kernel infinite loop at mount time, hanging the mounting thread and firing the soft-lockup watchdog within ~22s on multi-CPU hosts (panic with kernel.softlockup_panic=1).  The bug is reachable from desktop USB auto-mount on distributions where udisks2 routes the NTFS signature to the in-tree ntfs3 driver (Arch family and an increasing fraction of Fedora / openSUSE / RHEL deployments); CAP_SYS_ADMIN-class manual mount elsewhere.  check_rstbl()'s second walker iterates the free-entry singly-linked list headed by rt-\u003efirst_free with no upper bound on iteration count:    for (off = ff; off;) {       if (off == RESTART_ENTRY_ALLOCATED)           return false;       off = le32_to_cpu(*(__le32 *)Add2Ptr(rt, off));       if (off \u003e ts - sizeof(__le32))           return false;   }  The existing guards cover three exits: end-of-list (off == 0), the in-use marker (off == RESTART_ENTRY_ALLOCATED), and out-of-bounds (off \u003e ts - sizeof(__le32)).  None of the three prevents an in-bounds cycle.  A crafted on-disk RESTART_TABLE whose free chain contains a self-loop or A-\u003eB-\u003eA cycle whose offsets satisfy:    - in range [sizeof(struct RESTART_TABLE), ts - sizeof(__le32)]   - (off - sizeof(struct RESTART_TABLE)) % rsize == 0  passes all existing guards and spins the mount-time thread forever. Reproduced in UML by hand-forging a 2 MB NTFS3 image whose journal RESTART_TABLE first_free = 0x18 and whose entry at offset 0x18 stores 0x18 as its next pointer; mount of the forged image with the in-tree ntfs3 driver never returns.  Bound the walker by rt-\u003eused.  Each entry on a legitimate free chain is unique, and the total slot count is ne = le16_to_cpu (rt-\u003eused).  A traversal that visits more than ne slots is by construction malformed; reject it as a corrupt RESTART_TABLE.  After this patch, mount of the forged image returns with -EINVAL and a log_replay failure message, and mkntfs-produced legitimate images mount cleanly (verified in the same UML harness).",
  "id": "DEBIAN-CVE-2026-72193",
  "modified": "2026-09-14T16:47:41.088403001Z",
  "published": "2026-08-15T06:21:37.797Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://security-tracker.debian.org/tracker/CVE-2026-72193"
    }
  ],
  "upstream": [
    "CVE-2026-72193"
  ]
}