Cloudanix VulnDB

CVE-2026-99101

None

CVSS

—

EPSS

0.2%

Published

Oct 28, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A flaw in Linux's handling of certain NTFS file features can corrupt filesystem data and cause crashes or failed repairs.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Data Tampering
Component
OS kernel
Class
Memory Corruption
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Incorrect memmove during non-resident NTFS attribute record shrink in ntfs_new_attr_flags() copies bytes from an adjacent attribute instead of the original mapping pairs, leaving a malformed run-length array in the on-disk structure.

Why it matters to the business

Filesystem metadata corruption on Linux systems using NTFS volumes can cause file access failures, unexpected crashes during compression or sparse-file operations, and require offline repair, increasing downtime and recovery effort.

How an attack unfolds

An attacker with write access to an NTFS volume on Linux clears compression or sparse flags on a file, triggering the buggy shrink path; re-enabling compression then persists invalid mapping pairs that later cause ntfsck failures or kernel misbehavior when the file is accessed.

How to fix it

Apply the upstream kernel patch that moves attribute payload before shrinking the record; rebuild and boot the fixed kernel on all affected systems.

How to confirm the fix worked

Confirm the patch is present by inspecting the ntfs_new_attr_flags function for the corrected payload-move-before-shrink ordering; run ntfsck on test volumes after flag toggling to verify absence of malformed run-length reports.

Typical attack path

  1. Mount NTFS volume with write access on vulnerable kernel
  2. Create or open empty file and toggle compression/sparse flags to invoke ntfs_new_attr_flags shrink path
  3. Trigger subsequent access or ntfsck that interprets the corrupted mapping pairs

How to detect it

Review kernel logs for ntfsck reports of missing or invalid run length after compression changes; inspect NTFS volumes offline with tools that validate mapping pairs.

What your security team should do

  • Prioritize kernel update on any Linux system mounting NTFS volumes
  • Monitor upstream stable branches for the merged fix and schedule rapid deployment
  • Temporarily restrict compression flag changes on NTFS mounts if immediate patching is delayed

The record

In the Linux kernel, the following vulnerability has been resolved: ntfs: move attribute payload before shrinking its record ntfs_new_attr_flags() resizes the non-resident attribute record before moving its name and mapping pairs to their shorter-header offsets when compression or sparse state is cleared. Shrinking the record first moves the following attribute over the tail of the old record. The subsequent memmove() therefore copies bytes from that following attribute instead of the old mapping pairs. Re-enabling compression on an empty file persists those bytes as a malformed mapping pairs array, which ntfsck reports as a missing or invalid run length. Move the payload before shrinking the record, while retaining the existing resize-before-move ordering when growing it.

Affected packages

Ecosystem Package Introduced Fixed