CVE-2026-72188ntfs: sanitize MFT references returned from ntfs_lookup_inode_by_name()

Official description

In the Linux kernel, the following vulnerability has been resolved: ntfs: sanitize MFT references returned from ntfs_lookup_inode_by_name() ntfs_lookup_inode_by_name() returns MFT references read from directory index entries on disk. These values are untrusted, but the function can currently return an error-marked MFT reference to its callers without validating it. Callers later decode lookup failures with MREF_ERR(). A crafted NTFS image can set the MREF error bit while leaving the low bits as an arbitrary value, causing callers to consume a bogus pseudo-errno instead of treating the lookup result as corrupted on-disk metadata. Fix this at the source by normalizing every error-marked MFT reference returned from ntfs_lookup_inode_by_name() to ERR_MREF(-EIO). Apply this to all four directory lookup return paths so every caller gets a validated result without needing additional checks or an API change. This keeps the sanitization in the common lookup helper, which is cleaner than duplicating validation in each caller.

Affected packages & fixed versions

Affected products (as reported)

References

• https://git.kernel.org/stable/c/83f396d881c4fd312c7fd5fff2c157fc21104464
• https://git.kernel.org/stable/c/d97a36bae86a9a4021562ded2987f904e6bcb1d7