CVE-2026-99260

What it actually does

The flaw skips resident-to-non-resident conversion when sparse or compressed flags are applied to a resident NTFS attribute, leaving the attribute in an inconsistent state and terminating without error.

Why it matters to the business

Linux systems that mount NTFS volumes may experience metadata inconsistency, unexpected I/O errors, or crashes when applications attempt to mark resident files as sparse or compressed.

How an attack unfolds

An attacker with the ability to write to an NTFS filesystem on a Linux host issues filesystem operations that set sparse or compressed flags on resident attributes; the missing conversion path allows the kernel to accept invalid state without performing the required extent allocation.

How to fix it

Upgrade to a Linux kernel containing the fix for ntfs_new_attr_flags resident conversion; apply the patch or the next stable kernel release that resolves the improper flag handling.

How to confirm the fix worked

Confirm the running kernel contains the commit that adds resident-to-non-resident conversion before setting sparse or compressed flags on resident attributes; review NTFS attribute handling code paths for the conversion logic.

Typical attack path

1. Gain local shell or application execution on a Linux host with NTFS volumes mounted
2. Create or open a resident file on the NTFS volume
3. Invoke operations that request sparse or compressed attribute flags
4. Trigger termination of the flag-setting routine without conversion

How to detect it

Search kernel logs for ntfs-related warnings or oops entries around the time of file attribute changes on NTFS volumes; inspect audit logs for processes performing sparse or compressed flag operations on resident files.

What your security team should do

• Prioritize kernel updates on any systems that mount NTFS volumes
• Restrict untrusted local users from writing to NTFS filesystems until patched
• Monitor for kernel oops or warnings originating from ntfs code when flag operations occur