Cloudanix VulnDB

CVE-2026-99171

None

CVSS

—

EPSS

0.2%

Published

Oct 28, 2026

CISA due date

—

Cloudanix analysis

Next patch cycle SSVC: Track

A bug in how Linux handles certain file-system settings can let memory be accessed after it is freed, which may crash the computer or allow an attacker who already has access to the machine to gain more control.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Privilege Gain
Component
OS kernel
Class
Use After Free
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Use-after-free in ntfs3 when the nocase mount option is active: custom RCU dentry operations retain references to superblock private data that ntfs_put_super and ntfs3_kill_sb release without an RCU grace period, allowing a concurrent pathwalk to dereference freed memory.

Why it matters to the business

Systems using the ntfs3 driver with the nocase option can experience kernel crashes or memory corruption during filesystem unmount, leading to unplanned downtime, potential data loss on NTFS volumes, and elevated risk of local privilege escalation until patched.

How an attack unfolds

An attacker with local access mounts an NTFS volume using the nocase option, keeps a process performing filename lookups, then triggers unmount; the resulting UAF during ntfs_d_hash or ntfs_nls_to_utf16 can be leveraged for memory corruption and code execution in the kernel context.

How to fix it

Update to a kernel containing the referenced fix that moves ntfs3_free_sbi into an RCU callback and converts s_shared_lock to spin_lock_bh; rebuild and reboot with the updated kernel image.

How to confirm the fix worked

Confirm the running kernel contains the RCU-delayed sbi free path by inspecting the ntfs3 module source or binary symbols for ntfs3_free_sbi under call_rcu; attempt mount/umount cycles with nocase while monitoring for KASAN reports.

Typical attack path

  1. Obtain local user access on a Linux system with ntfs3 loaded
  2. Mount an NTFS volume with the nocase option
  3. Initiate concurrent file operations that perform path walks
  4. Trigger unmount of the volume while lookups remain in flight
  5. Exploit the resulting slab use-after-free for arbitrary kernel read/write or DoS

How to detect it

Review kernel logs for KASAN reports referencing ntfs_nls_to_utf16 or ntfs_d_hash during unmount; correlate with audit records showing mount/umount of NTFS volumes using nocase; inspect crash dumps for slab-use-after-free in the ntfs3 superblock structures.

What your security team should do

  • Prioritize kernel updates on all systems exposing NTFS volumes via ntfs3
  • Temporarily avoid the nocase mount option where operationally feasible
  • Add kernel memory-safety tooling (KASAN/KMSAN) to CI for filesystem mount stress tests
  • Monitor vendor advisories for backported fixes in distribution kernels

The record

In the Linux kernel, the following vulnerability has been resolved: ntfs3: free the sbi after a grace period If the "nocase" mount option ntfs3 uses custom hash and dentry compare functions. Both access ntfs3 superblock private information in rcu pathwalk. ntfs_put_super() and ntfs3_kill_sb() drop the info without any rcu delay. A lookup that's still inside the filesystem when the last reference to the mount is dropped causes a UAF. With a pathwalk held up in ntfs_d_hash() while the last reference to the mount goes away: BUG: KASAN: slab-use-after-free in ntfs_nls_to_utf16+0x752/0x940 Read of size 8 at addr ff1100010453c850 by task walker/99 Call Trace: <TASK> ntfs_nls_to_utf16+0x752/0x940 ntfs_d_hash+0x22b/0x500 link_path_walk+0x11ad/0x1d30 path_lookupat+0x63/0xb00 filename_lookup+0x1f1/0x5b0 vfs_statx+0xd7/0x3b0 [...] Allocated by task 95: __kmalloc_cache_noprof+0x249/0x560 ntfs_init_fs_context+0x2db/0x5a0 alloc_fs_context+0x52e/0xc70 [...] Freed by task 98: kfree+0x1db/0x5b0 deactivate_locked_super+0x9c/0xf0 cleanup_mnt+0x9f/0x130 task_work_run+0x131/0x250 The bug is currently masked by the grace period in namespace_unlock() for umount(2). Keep the necessary information until the filesystem private info is freed and free it with an rcu delay. ntfs3_free_sbi() now runs from an rcu callback and drops the upcase table via ntfs_put_shared(). So switch s_shared_lock over to spin_lock_bh(). Otherwise the callback can deadlock against a task holding the lock on the same cpu.

Affected packages

Ecosystem Package Introduced Fixed