In CVE-2026-72202, the NTFS subsystem had a heap allocation in __get_nr_free_clusters() that wasn't merely a memory management choice—it was a silent gatekeeper for publishing results. When kmalloc failed for the temporary readahead state, callers waiting on free_waitq were never woken. The system didn't crash, didn't panic, didn't log anything. Operations simply hung, indefinitely, while locks accumulated and the NTFS layer backed up behind them.
This wasn't a design decision that was carefully weighed and found acceptable. Version control history suggests developers grabbed a familiar pattern—allocate, use, free—without reasoning through what allocation failure actually means in wait/wake semantics. The same invisible deadlock appeared in __get_nr_free_mft_records(), confirming this was copy-paste propagation rather than independent oversight. Two locations, identical hidden failure mode, same root cause: heap allocation used as a synchronization mechanism without treating its failure as a semantic violation.
The stack-based fix is striking because it eliminates the entire problem class, not just this instance. The file_ra_state is fixed-size, used synchronously, and zero-initialized is sufficient. By moving it to the stack, there's no allocation to fail, no conditional wakeup logic, no conservative fallback that might be wrong. The error handling simply doesn't exist—which is exactly what makes the code safer. When you eliminate an error path, you eliminate the possibility of exploits hiding in that error handling for years.
The deeper issue is that heap allocation is culturally treated as a neutral implementation detail in kernel review, when it's actually a semantic commitment: this function will only publish results if memory is available. That contract was never documented at the allocation site, which is how the failure path was forgotten. The stack fix implicitly documents the invariant by making it impossible to violate.
For auditing: grep for allocations followed by waitqueue wake operations in the same function—that catches the pattern. But the deeper heuristic is identifying allocations whose failure doesn't cause an immediate crash but instead creates semantic corruption: callers waiting forever, state that appears valid but isn't, retry loops that pile up waiting tasks while underlying resource exhaustion continues. This pattern almost certainly exists elsewhere in the kernel, not from malice but because developers pattern-match without tracing the failure chain forward. The backlog is likely measured in dozens.