CVE-2026-98138

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-98138", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.319Z", "datePublished": "2026-09-25T10:36:15.349Z", "dateUpdated": "2026-10-19T09:14:31.951Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-19T09:14:31.951Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nntfs: do not mark the volume clean in sync_fs when errors were recorded\n\nntfs_put_super() and the remount-read-only path both clear the dirty bit\nonly when NVolErrors(vol) is false. ntfs_sync_fs() clears it\nunconditionally, so any sync() on a volume that recorded an error marks\nthat volume clean. A volume without this set is then seen as not needing\nrecovery and it does not run one, so whatever went wrong is never repaired.\n\nThis change skips resetting the dirty bit when there are volume errors.\n\nReproduced on a volume whose $MFTMirr does not match $MFT, which sets the\nerror flag while leaving the mount read-write: after a write and a sync,\nthe on-disk volume flags read 0x0000 with this driver and 0x0001 with the\nguard in place."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/ntfs/super.c"], "versions": [{"version": "6251f0b0de7d645e3591931ca4c11d8322c1866f", "lessThan": "ca1f9933eff777a604eb664d0f9ae433b8664cbf", "status": "affected", "versionType": "git"}, {"version": "6251f0b0de7d645e3591931ca4c11d8322c1866f", "lessThan": "0e4c839905418d55bafe571a92533a1d1ac7b0a8", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/ntfs/super.c"], "versions": [{"version": "7.1", "status": "affected"}, {"version": "0", "lessThan": "7.1", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.7", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "7.1", "versionEndExcluding": "7.2.7"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "7.1", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/ca1f9933eff777a604eb664d0f9ae433b8664cbf"}, {"url": "https://git.kernel.org/stable/c/0e4c839905418d55bafe571a92533a1d1ac7b0a8"}], "title": "ntfs: do not mark the volume clean in sync_fs when errors were recorded", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["fs/ntfs/super.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "ca1f9933eff777a604eb664d0f9ae433b8664cbf", "status": "affected", "version": "6251f0b0de7d645e3591931ca4c11d8322c1866f", "versionType": "git"}, {"lessThan": "0e4c839905418d55bafe571a92533a1d1ac7b0a8", "status": "affected", "version": "6251f0b0de7d645e3591931ca4c11d8322c1866f", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["fs/ntfs/super.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "7.1"}, {"lessThan": "7.1", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.7", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "14D603E7-156F-4FD7-926F-F8D893FBAD60", "versionEndExcluding": "7.2.7", "versionStartIncluding": "7.1", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.3:rc1:*:*:*:*:*:*", "matchCriteriaId": "11E35E1B-5DB4-4AB9-9706-CD73B799EADF", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nntfs: do not mark the volume clean in sync_fs when errors were recorded\n\nntfs_put_super() and the remount-read-only path both clear the dirty bit\nonly when NVolErrors(vol) is false. ntfs_sync_fs() clears it\nunconditionally, so any sync() on a volume that recorded an error marks\nthat volume clean. A volume without this set is then seen as not needing\nrecovery and it does not run one, so whatever went wrong is never repaired.\n\nThis change skips resetting the dirty bit when there are volume errors.\n\nReproduced on a volume whose $MFTMirr does not match $MFT, which sets the\nerror flag while leaving the mount read-write: after a write and a sync,\nthe on-disk volume flags read 0x0000 with this driver and 0x0001 with the\nguard in place."}], "id": "CVE-2026-98138", "lastModified": "2026-10-19T10:18:13.003", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2026-09-25T11:17:45.273", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/0e4c839905418d55bafe571a92533a1d1ac7b0a8"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/ca1f9933eff777a604eb664d0f9ae433b8664cbf"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: ntfs: do not mark the volume clean in sync_fs when errors were recorded", "id": "2541374", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2541374"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-390", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nntfs: do not mark the volume clean in sync_fs when errors were recorded\nntfs_put_super() and the remount-read-only path both clear the dirty bit\nonly when NVolErrors(vol) is false. ntfs_sync_fs() clears it\nunconditionally, so any sync() on a volume that recorded an error marks\nthat volume clean. A volume without this set is then seen as not needing\nrecovery and it does not run one, so whatever went wrong is never repaired.\nThis change skips resetting the dirty bit when there are volume errors.\nReproduced on a volume whose $MFTMirr does not match $MFT, which sets the\nerror flag while leaving the mount read-write: after a write and a sync,\nthe on-disk volume flags read 0x0000 with this driver and 0x0001 with the\nguard in place.", "A flaw was found in the Linux kernel's NTFS file system driver. When synchronizing the file system, the driver unconditionally clears the volume's dirty state flag even if errors were previously encountered. A local user capable of triggering a file system synchronization on a volume with recorded errors can cause the volume to be marked as clean. Consequently, automated recovery and repair tools may fail to run during subsequent mounts, leading to persistent file system inconsistency and data corruption."], "name": "CVE-2026-98138", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-09-25T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-98138\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-98138\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98138.mbox"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[6251f0b0de7d645e3591931ca4c11d8322c1866f,ca1f9933eff777a604eb664d0f9ae433b8664cbf)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[6251f0b0de7d645e3591931ca4c11d8322c1866f,0e4c839905418d55bafe571a92533a1d1ac7b0a8)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "7.1"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,7.1)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.7,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.3-rc2,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-09-25T12:30:08.705065+00:00", "updated": "2026-10-08T20:00:02.786379+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}