Cloudanix VulnDB

CVE-2026-98139

Medium · 5.5

CVSS

5.5

EPSS

0.1%

Published

Sep 25, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A flaw in tracking free space on certain file systems can make the computer think it has more room than it really does, which may cause programs to fail when trying to save data.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Low
Impact
Denial Of Service
Component
OS kernel
Class
Other
Remediation
Upgrade
Effort
Medium
Patch risk
Medium

What it actually does

The ntfs_cluster_free_from_rl_nolock function increments the free_clusters counter for runs even when ntfs_bitmap_clear_run fails, causing the in-memory free-space accounting to become larger than reality and producing incorrect statfs values plus allocator gate decisions.

Why it matters to the business

Systems may report inflated free space, leading to unexpected allocation failures, application errors when writing data, and degraded reliability for workloads that rely on accurate NTFS storage statistics.

How an attack unfolds

An attacker with local access triggers NTFS cluster-free operations that encounter bitmap-clear failures (for example through concurrent access or specific error conditions); because failed runs still inflate the free-cluster count, subsequent allocation decisions become inconsistent, potentially resulting in denial-of-service via storage exhaustion or crashes.

How to fix it

Update to a Linux kernel version that contains the corrected ntfs_cluster_free_from_rl_nolock logic ensuring only successfully cleared runs are counted; rebuild and reboot with the patched kernel; verify the fix by confirming the upstream commit that gates the nr_freed increment on bitmap success.

How to confirm the fix worked

After applying the kernel update, exercise NTFS workloads that previously triggered bitmap-clear errors and confirm that free_clusters and statfs output no longer over-report space; monitor kernel logs for related NTFS bitmap warnings during validation testing.

Typical attack path

  1. Obtain local user access on a Linux system using NTFS volumes
  2. Perform or induce file-system operations that free clusters and encounter ntfs_bitmap_clear_run failures
  3. Observe or force repeated allocation attempts that rely on the now-inflated free_clusters value
  4. Trigger allocation failures or kernel paths that depend on the corrupted accounting to achieve denial of service

How to detect it

Search kernel logs and audit trails for repeated NTFS bitmap-clear failures or statfs values that diverge from actual volume usage; look for processes performing heavy cluster allocation or deallocation on NTFS mounts around the time of observed storage anomalies.

What your security team should do

  • Prioritize patching Linux kernel packages on any system hosting NTFS volumes within the next maintenance window
  • Add the corrected kernel to golden images and CI build pipelines
  • Review and test NTFS-dependent workloads for allocation behavior under error conditions
  • Monitor upstream stable branches for the specific ntfs free-cluster accounting fix

The record

In the Linux kernel, the following vulnerability has been resolved: ntfs: only count successfully cleared runs when freeing clusters ntfs_cluster_free_from_rl_nolock() adds a run's length to nr_freed whenever the error bookkeeping condition is false, which includes cases where ntfs_bitmap_clear_run() actually failed - e.g. a second run failing with the same errno as an earlier one, or any failure after a non-ENOMEM error was already recorded. Since a failed ntfs_bitmap_clear_run() rolls back its partial modifications, no bits were cleared for that run, yet its length still inflates vol->free_clusters, corrupting statfs output and the allocator's free space gate. Only count runs whose bitmap clear succeeded.

Affected packages

Ecosystem Package Introduced Fixed