{
  "affected": [
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:14",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "7.1.5-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:  ntfs: free volume-wide resources on fill_super failure  ntfs_fill_super()'s err_out_now path frees only the volume struct via kfree(vol), leaving several vol-owned allocations behind on every mount failure:    - vol-\u003enls_map, loaded by ntfs_init_fs_context() via     load_nls_default() (or replaced by an explicit nls= option in     ntfs_parse_param()), is never unload_nls()'d.    - vol-\u003evolume_label, allocated by load_system_files() through     ntfs_ucstonls() once the $Volume name attribute has been parsed, is     not released by load_system_files()'s own error labels nor by the     fill_super() inline cleanup that only runs on d_make_root()     failure.  Any later failure inside load_system_files() leaks it.    - vol-\u003elcn_empty_bits_per_page was kvfree()'d in     unl_upcase_iput_tmp_ino_err_out_now without clearing the pointer,     so it could not be folded into a single common cleanup.  Because the failure paths never call ntfs_volume_free() and never reach the d_make_root() inline cleanup block (it sits above the label and is jumped over by the load_system_files() / kvmalloc failure gotos), these resources accumulate per failed mount attempt with no chance of recovery short of unloading the module.  This is a silent leak: the inodes loaded prior to failure remain hashed but generic_shutdown_super() skips evict_inodes() when sb-\u003es_root is unset, so no CHECK_DATA_CORRUPTION warning is emitted either.  Move the per-volume frees down to err_out_now and drop the lcn_empty_bits_per_page kvfree() from the upper label so the cleanup is performed exactly once on every failure path.  Using unconditional kvfree() / kfree() / unload_nls() is safe because they all accept NULL and the upper labels that previously freed nls_map (the d_make_root() inline cleanup) already clear the pointer.",
  "id": "DEBIAN-CVE-2026-72205",
  "modified": "2026-09-14T16:47:35.100208127Z",
  "published": "2026-08-15T06:21:39.190Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://security-tracker.debian.org/tracker/CVE-2026-72205"
    }
  ],
  "upstream": [
    "CVE-2026-72205"
  ]
}