Cloudanix VulnDB

CVE-2026-99242

None

CVSS

—

EPSS

0.1%

Published

Nov 2, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A timing flaw in the Linux kernel can let one program on the same computer read leftover data from a disk while another program is clearing space for new files, risking exposure of private information.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Data Exposure
Component
OS kernel
Class
Race Condition
Remediation
Patch
Effort
Medium
Patch risk
Low

What it actually does

Race condition in NTFS fallocate where invalidate_lock is not held for standard allocation modes, allowing concurrent mmap page faults via filemap_fault to read uninitialized clusters before ntfs_dio_zero_range completes, resulting in information disclosure and data integrity violations.

Why it matters to the business

On multi-user Linux systems using NTFS, local processes can leak sensitive disk contents or corrupt allocated data, increasing risk of unauthorized information exposure in shared environments; urgency is high due to publication only one day ago.

How an attack unfolds

An attacker with local access allocates space on an NTFS file using fallocate without the lock, then triggers page faults through mmap in a concurrent process to fault in pages exposing old disk data before zeroing occurs.

How to fix it

Upgrade the Linux kernel to a version containing the fix that acquires invalidate_lock for every fallocate operation including standard allocation modes.

How to confirm the fix worked

Inspect kernel source for ntfs_attr_fallocate acquiring invalidate_lock on all code paths, or run concurrency tests exercising fallocate plus mmap to confirm no uninitialized reads occur.

Typical attack path

  1. Gain local execution on Linux system with NTFS volume
  2. Open or create target file and invoke fallocate with mode 0
  3. Concurrently map the same file region and induce page faults
  4. Read resulting pages to obtain unzeroed prior disk contents

How to detect it

Examine system call traces or audit logs for concurrent fallocate and mmap activity on NTFS files; no persistent artifacts are expected after successful exploitation.

What your security team should do

  • Prioritize kernel updates within the next patch cycle
  • Limit untrusted local code execution on systems hosting NTFS volumes
  • Review application use of fallocate and mmap together for additional hardening

The record

In the Linux kernel, the following vulnerability has been resolved: ntfs: fix race between fallocate and mmap reads The fallocate implementation only takes invalidate_lock for punch hole, collapse range, and insert range operations. For standard allocation modes (mode == 0, FALLOC_FL_KEEP_SIZE), the lock is not held. During ntfs_attr_fallocate(), new clusters are mapped to the runlist via ntfs_attr_map_cluster() before being zeroed by ntfs_dio_zero_range(). This creates a window where concurrent mmap page faults can read uninitialized disk data. Since mmap uses filemap_fault() which takes invalidate_lock in shared mode, it can fault in pages during this window and expose old disk contents to userspace. This is an information leak and data integrity issue. Fix by taking invalidate_lock for all fallocate operations, not just for punch/collapse/insert modes. This prevents concurrent page faults from accessing unzeroed clusters during the allocation window.

Affected packages

Ecosystem Package Introduced Fixed