CVE-2026-99107

What it actually does

The vulnerability causes ntfs_new_attr_flags() to pass the base MFT record instead of the correct extent MFT record (ctx->mrec) to ntfs_attr_record_resize(), resulting in incorrect size calculations and erroneous memmove operations that corrupt kernel memory structures.

Why it matters to the business

Linux systems mounting NTFS volumes face risk of kernel instability, crashes, or local memory corruption that could enable privilege escalation; impact is limited by low exploit probability and recent publication with no known widespread exploitation.

How an attack unfolds

A local attacker triggers NTFS attribute flag updates on files whose attributes reside in extent records, supplying the wrong base record pointer and inducing invalid memory moves during resize that corrupt adjacent kernel data.

How to fix it

Upgrade the Linux kernel to a version containing the fix that passes ctx->mrec rather than the base record m to ntfs_attr_record_resize; rebuild and deploy the patched kernel across affected systems.

How to confirm the fix worked

Inspect kernel source for the corrected call site using ctx->mrec; boot the updated kernel and exercise NTFS attribute operations on extent records while monitoring for memory errors or panics.

Typical attack path

1. Obtain local user access on a Linux system
2. Mount or access an NTFS volume containing files with extended attributes
3. Perform operations that invoke ntfs_new_attr_flags on extent-resident attributes
4. Force ntfs_attr_record_resize to receive the incorrect base MREC pointer
5. Trigger memmove with erroneous offsets leading to kernel memory corruption

How to detect it

Review kernel logs (dmesg, syslog) for oops/panic entries referencing ntfs_attr_record_resize, memmove, or MFT record handling around the time of suspected activity.

What your security team should do

• Prioritize kernel updates for systems that mount untrusted NTFS volumes
• Restrict local user ability to mount arbitrary NTFS filesystems until patched
• Enable kernel hardening features such as KASAN or hardened usercopy where available