CVE-2026-98315

What it actually does

Race condition in NTFS runlist handling allows concurrent modifications without proper locking, leading to use-after-free or inconsistent on-disk/in-memory state during attribute shrink and cluster mapping operations.

Why it matters to the business

Local attackers with low privileges can achieve kernel code execution or denial of service on systems using NTFS volumes, risking full system compromise; low exploitability reduces immediate widespread risk but still requires prompt patching on affected Linux deployments.

How an attack unfolds

An attacker with local access triggers ntfs_non_resident_attr_shrink or ntfs_attr_map_cluster concurrently from multiple threads or processes on an NTFS volume, racing the missing runlist write lock to corrupt runlist state and either free clusters improperly or fail rollbacks, resulting in memory corruption that can be turned into privilege escalation.

How to fix it

Update to a Linux kernel containing the fix that serializes runlist operations under the write lock; rebuild and reboot with the patched kernel; consider disabling NTFS write support on high-risk systems until updated.

How to confirm the fix worked

Verify the running kernel source or binary contains the runlist lock acquisition around ntfs_non_resident_attr_shrink and ntfs_attr_map_cluster rollback paths; test by mounting NTFS volumes and exercising attribute resize under concurrency while monitoring for kernel warnings or crashes.

Typical attack path

1. Obtain local unprivileged access on a Linux system mounting NTFS
2. Create or open an NTFS file with non-resident attributes
3. Trigger concurrent shrink and map-cluster operations via crafted I/O or filesystem calls
4. Exploit resulting memory corruption for kernel read/write or code execution
5. Escalate to root or persist via kernel-level payload

How to detect it

Review kernel logs (dmesg, syslog) for NTFS runlist or mapping pair errors; look for unexpected volume error states or crashes during file attribute operations on NTFS; no public exploit artifacts known.

What your security team should do

• Prioritize kernel upgrades on any Linux systems exposing NTFS volumes to untrusted local users
• Apply the patch that adds runlist locking within 30 days given the local high-impact nature
• Monitor kernel logs for NTFS-related warnings on production systems
• Restrict local user access to NTFS mounts where feasible until patched