Cloudanix VulnDB

CVE-2026-98880

None

CVSS

—

EPSS

0.2%

Published

Oct 23, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A flaw in Linux's handling of certain Windows-formatted drives can cause the computer to crash when it tries to access those drives.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Moderate
Impact
Denial Of Service
Component
OS kernel
Class
Improper Input Validation
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Improper handling of block sizes larger than PAGE_SIZE in ntfs3 buffer_heads triggers a BUG_ON in folio_set_bh during the first __bread_gfp call on mount.

Why it matters to the business

Mounting certain NTFS volumes can cause immediate kernel crashes, leading to system reboots, loss of availability, and potential data corruption on affected Linux systems.

How an attack unfolds

An attacker supplies an NTFS filesystem image configured with block size exceeding PAGE_SIZE; when the victim attempts to mount it, the unhandled failure path in ntfs3 hits the kernel assertion and panics the system.

How to fix it

Apply the upstream kernel commit that adds proper set_blocksize failure handling in ntfs3; rebuild and deploy the patched kernel across all affected systems.

How to confirm the fix worked

Confirm the fix is present by inspecting the ntfs3 mount code for set_blocksize error paths; test by attempting to mount a block-size > PAGE_SIZE NTFS image and verifying no BUG_ON occurs.

Typical attack path

  1. Create or modify an NTFS volume with block size > PAGE_SIZE
  2. Deliver the image to the target (USB, network share, or download)
  3. Induce the target to execute mount on the image
  4. Kernel hits BUG_ON and panics

How to detect it

Search kernel logs (dmesg, /var/log/kern.log, journalctl) for BUG_ON messages containing folio_set_bh or folio_size during ntfs3 mount attempts; correlate with recent mount operations of external media.

  • BUG_ON(offset >= folio_size(folio))
  • folio_set_bh
  • ntfs3: set_blocksize

What your security team should do

  • Prioritize kernel updates on all systems that may mount external NTFS volumes
  • Restrict mounting of untrusted or removable NTFS media via policy or fstab options
  • Monitor kernel logs for folio_set_bh or ntfs3 BUG_ON entries

The record

In the Linux kernel, the following vulnerability has been resolved: ntfs3: handle set_blocksize failures ntfs3 uses buffer_heads, which don't handle block size > PAGE_SIZE well. Without this, mounting we will hit the BUG_ON(offset >= folio_size(folio)); in folio_set_bh on the first __bread_gfp call.

Affected packages

Ecosystem Package Introduced Fixed