Cloudanix VulnDB

CVE-2026-99102

None

CVSS

—

EPSS

0.2%

Published

Oct 28, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A timing bug in the Linux code that handles growing or shrinking files on Windows-style NTFS drives can make programs crash with a bus error during normal use.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Denial Of Service
Component
OS kernel
Class
Race Condition
Remediation
Patch
Effort
Medium
Patch risk
Low

What it actually does

Race condition in ntfs_setattr_size allows page faults to observe transient runlist state during non-resident attribute resize without invalidate_lock held, causing spurious SIGBUS or interleaved size updates with truncate_pagecache and i_size_write.

Why it matters to the business

Applications accessing files on Linux NTFS volumes may experience unexpected crashes or inconsistent file views after size changes, increasing operational risk on systems using the ntfs driver for data exchange or dual-boot environments; urgency is low given recent publication and absence from known exploitation lists.

How an attack unfolds

An attacker with local access maps a file backed by an NTFS attribute, then concurrently triggers ntfs_setattr_size while inducing page faults; the missing exclusive invalidate_lock permits the fault handler to resolve VCNs against an expanding runlist, surfacing SIGBUS or allowing size epilogue interleaving that corrupts page cache state.

How to fix it

Apply the upstream kernel patch that acquires invalidate_lock exclusively around the resize operation after inode_dio_wait; rebuild and deploy the fixed kernel, or upgrade to a distribution release containing the ntfs setattr size locking fix.

How to confirm the fix worked

Confirm the patch is present by inspecting fs/ntfs/attrib.c for the invalidate_lock acquisition around ntfs_setattr_size; test by concurrently performing size changes and page faults on NTFS files and verifying absence of SIGBUS.

Typical attack path

  1. Obtain local unprivileged access on a Linux system mounting NTFS volumes
  2. Open and mmap a target file on the NTFS filesystem
  3. Trigger concurrent ftruncate or fallocate operations while generating page faults on the mapping
  4. Observe spurious SIGBUS delivery or inconsistent file data after the resize completes

How to detect it

Review kernel logs for repeated SIGBUS signals on processes accessing NTFS files during size-changing operations; examine audit logs for sequences of mmap, ftruncate, and page fault events on ntfs inodes; no widespread exploitation indicators exist given the vulnerability's age and low EPSS.

What your security team should do

  • Prioritize kernel updates on multi-user or shared systems that mount NTFS volumes within the next maintenance window
  • Monitor upstream stable kernel releases for backports of the invalidate_lock change
  • Restrict untrusted local accounts from mounting or writing to NTFS volumes until patched

The record

In the Linux kernel, the following vulnerability has been resolved: ntfs: take invalidate_lock in ntfs_setattr_size() ntfs_setattr_size() updates i_size and resizes the on-disk attribute without holding mapping->invalidate_lock. Page faults take the lock shared, so a fault racing the resize can resolve a VCN against the transient runlist state of ntfs_non_resident_attr_expand() and fail with a spurious SIGBUS, and can interleave with the size-change epilogue (truncate_pagecache(), i_size_write(), pagecache_isize_extended()). Take invalidate_lock exclusively around the whole resize after inode_dio_wait(), matching the fallocate path and other filesystems such as xfs, which wraps truncate in its mmaplock (= invalidate_lock).

Affected packages

Ecosystem Package Introduced Fixed