CVE-2026-98137

What it actually does

Failed zero-out operations in ntfs_dio_zero_range during ntfs_attr_fallocate were silently ignored because the return-value check never triggered on negative errno values, allowing newly allocated clusters to be marked initialized and writes to complete while leaving stale on-disk data.

Why it matters to the business

Local users on Linux systems using NTFS volumes may experience undetected data-integrity failures, resulting in files that contain old or uninitialized content after allocation operations.

How an attack unfolds

A local attacker with write access to an NTFS filesystem issues fallocate calls that cause blkdev_issue_zeroout to fail; because the failure is ignored, the allocation loop continues, the clusters are folded into initialized_size, and subsequent writes succeed while exposing or preserving stale data.

How to fix it

Apply the upstream kernel commit that changes ntfs_attr_fallocate to treat any nonzero return from ntfs_dio_zero_range as an error and abort allocation; rebuild and deploy the fixed kernel to all affected systems.

How to confirm the fix worked

Confirm the presence of the corrected ntfs_attr_fallocate logic that aborts on any nonzero ntfs_dio_zero_range return; test by forcing a zero-range failure and verifying the operation now returns an error instead of proceeding.

Typical attack path

1. Obtain local user access on a Linux host
2. Gain write access to an NTFS volume or image
3. Trigger ntfs_attr_fallocate with a zero-range request that fails inside blkdev_issue_zeroout
4. Observe the allocation succeeding and writes completing without error
5. Read back data that contains stale on-disk contents

How to detect it

Examine kernel logs and audit trails for unexpected success of fallocate or write operations on NTFS volumes immediately after zero-range requests; correlate with application-level reports of stale data appearing in newly allocated regions.

What your security team should do

• Prioritize kernel updates that contain the ntfs zero-range fix on all systems hosting NTFS volumes
• Restrict untrusted local accounts from write access to NTFS filesystems until patched
• Review application code that performs fallocate on NTFS to ensure explicit error handling