CVE-2026-72190

In the Linux kernel, the following vulnerability has been resolved:

ntfs: fix mrec_lock ABBA deadlock in rename

ntfs_file_fsync(), ntfs_dir_fsync() and __ntfs_write_inode() lock an

inode's mrec_lock before taking the mrec_lock of its parent directory.

ntfs_rename() takes old_ni->mrec_lock and old_dir_ni->mrec_lock

before taking new_ni->mrec_lock for an existing target, or

new_dir_ni->mrec_lock for a cross-directory rename.

This can deadlock when ntfs_file_fsync() or __ntfs_write_inode() holds

the target inode, or when ntfs_dir_fsync() holds a child target

directory, while rename() holds the parent directory and waits for the

target.

Fix this by locking the existing target inode before taking any parent

directory mrec_lock. For cross-directory renames where the target parent

is a descendant of the source parent, lock the target parent before the

source parent so the directory order matches the child-to-parent order used

by ntfs_file_fsync(), ntfs_dir_fsync(), and __ntfs_write_inode().