CVE-2026-72188

In the Linux kernel, the following vulnerability has been resolved:

ntfs: sanitize MFT references returned from ntfslookupinodebyname()

ntfslookupinodebyname() returns MFT references read from directory

index entries on disk. These values are untrusted, but the function can

currently return an error-marked MFT reference to its callers without

validating it.

Callers later decode lookup failures with MREF_ERR(). A crafted NTFS image

can set the MREF error bit while leaving the low bits as an arbitrary

value, causing callers to consume a bogus pseudo-errno instead of treating

the lookup result as corrupted on-disk metadata.

Fix this at the source by normalizing every error-marked MFT reference

returned from ntfslookupinodebyname() to ERR_MREF(-EIO). Apply this to

all four directory lookup return paths so every caller gets a validated

result without needing additional checks or an API change.

This keeps the sanitization in the common lookup helper, which is cleaner

than duplicating validation in each caller.