{"apiVersion":"1.0","identifier":"CVE-2026-72205","description":"In the Linux kernel, the following vulnerability has been resolved: ntfs: free volume-wide resources on fill_super failure ntfs_fill_super()-s err_out_now path frees only the volume struct via kfree(vol), leaving several vol-owned allocations behind on every mount failure: - vol->nls_map, loaded by ntfs_init_fs_context() via load_nls_default() (or replaced by an explicit nls= option in ntfs_parse_param()), is never unload_nls()-d. - vol->volume_label, allocated by load_system_files() through ntfs_ucstonls() once the $Volume name attribute has been parsed, is not released by load_system_files()-s own error labels nor by the fill_super() inline cleanup that only runs on d_make_root() failure. Any later failure inside load_system_files() leaks it. - vol->lcn_empty_bits_per_page was kvfree()-d in unl_upcase_iput_tmp_ino_err_out_now without clearing the pointer, so it could not be folded into a single common cleanup. Because the failure paths never call ntfs_volume_free() and never reach the d_make_root() inline cleanup block (it sits above the label and is jumped over by the load_system_files() / kvmalloc failure gotos), these resources accumulate per failed mount attempt with no chance of recovery short of unloading the module. This is a silent leak: the inodes loaded prior to failure remain hashed but generic_shutdown_super() skips evict_inodes() when sb->s_root is unset, so no CHECK_DATA_CORRUPTION warning is emitted either. Move the per-volume frees down to err_out_now and drop the lcn_empty_bits_per_page kvfree() from the upper label so the cleanup is performed exactly once on every failure path. Using unconditional kvfree() / kfree() / unload_nls() is safe because they all accept NULL and the upper labels that previously freed nls_map (the d_make_root() inline cleanup) already clear the pointer.","publishedAt":"2026-08-15T06:21:39","lastModifiedAt":"2026-08-18T07:16:53","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-72205","cvssScore":null,"cvssVector":"Pending","epssProbability":0.00198,"riskScore":0,"affectedProduct":"Linux kernel","affectedVersions":"unknown","vulnerabilityType":"Kernel","operatingSystems":[],"links":{"self":"https://www.redsauce.net/api/cves/CVE-2026-72205","webPages":{"es":"https://www.redsauce.net/es/cves/CVE-2026-72205","en":"https://www.redsauce.net/en/cves/CVE-2026-72205","fr":"https://www.redsauce.net/fr/cves/CVE-2026-72205","pt":"https://www.redsauce.net/pt/cves/CVE-2026-72205","de":"https://www.redsauce.net/de/cves/CVE-2026-72205","sk":"https://www.redsauce.net/sk/cves/CVE-2026-72205","el":"https://www.redsauce.net/el/cves/CVE-2026-72205"},"source":"https://nvd.nist.gov/vuln/detail/CVE-2026-72205"}}