CVE-2026-99241

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-99241", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.403Z", "datePublished": "2026-11-02T16:06:44.163Z", "dateUpdated": "2026-11-02T16:06:44.163Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-11-02T16:06:44.163Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nntfs: take invalidate_lock in ntfs_filemap_page_mkwrite()\n\nntfs_filemap_page_mkwrite() calls iomap_page_mkwrite() without holding\nmapping->invalidate_lock, so a concurrent truncate or fallocate can be\nin the middle of invalidating pagecache and rewriting the runlist while\nthe write fault maps blocks and dirties the folio. This races with\nntfs_attr_fallocate(), which merges clusters into the in-memory\nrunlist, drops the runlist lock, and only afterwards zeroes the newly\nallocated clusters on disk; and with the punch-hole/insert/collapse\npaths that free clusters after truncating the cache.\n\nPer Documentation/filesystems/locking.rst, ->page_mkwrite() must ensure\nthere are no truncate/invalidate races, \"usually mapping->invalidate_lock\nis suitable for proper serialization\". xfs takes its mmaplock (= the\ninvalidate_lock rwsem) shared in exactly this path.\n\nTake invalidate_lock shared around iomap_page_mkwrite(). The read-only\nfault path is already covered because filemap_fault() itself grabs\ninvalidate_lock shared on instantiation/read paths; only page_mkwrite\nwas bypassing it in this driver."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/ntfs/file.c"], "versions": [{"version": "9c87959601e80b39a45250e362e6ddfec17cb0fa", "lessThan": "57c0d5281666d150c73e56e6795a4eef3ede8693", "status": "affected", "versionType": "git"}, {"version": "9c87959601e80b39a45250e362e6ddfec17cb0fa", "lessThan": "0fecc393f2060e6bc25138df32cb923ec7071c6b", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/ntfs/file.c"], "versions": [{"version": "7.1", "status": "affected"}, {"version": "0", "lessThan": "7.1", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.14", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "7.1", "versionEndExcluding": "7.2.14"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "7.1", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/57c0d5281666d150c73e56e6795a4eef3ede8693"}, {"url": "https://git.kernel.org/stable/c/0fecc393f2060e6bc25138df32cb923ec7071c6b"}], "title": "ntfs: take invalidate_lock in ntfs_filemap_page_mkwrite()", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["fs/ntfs/file.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "57c0d5281666d150c73e56e6795a4eef3ede8693", "status": "affected", "version": "9c87959601e80b39a45250e362e6ddfec17cb0fa", "versionType": "git"}, {"lessThan": "0fecc393f2060e6bc25138df32cb923ec7071c6b", "status": "affected", "version": "9c87959601e80b39a45250e362e6ddfec17cb0fa", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["fs/ntfs/file.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "7.1"}, {"lessThan": "7.1", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.14", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nntfs: take invalidate_lock in ntfs_filemap_page_mkwrite()\n\nntfs_filemap_page_mkwrite() calls iomap_page_mkwrite() without holding\nmapping->invalidate_lock, so a concurrent truncate or fallocate can be\nin the middle of invalidating pagecache and rewriting the runlist while\nthe write fault maps blocks and dirties the folio. This races with\nntfs_attr_fallocate(), which merges clusters into the in-memory\nrunlist, drops the runlist lock, and only afterwards zeroes the newly\nallocated clusters on disk; and with the punch-hole/insert/collapse\npaths that free clusters after truncating the cache.\n\nPer Documentation/filesystems/locking.rst, ->page_mkwrite() must ensure\nthere are no truncate/invalidate races, \"usually mapping->invalidate_lock\nis suitable for proper serialization\". xfs takes its mmaplock (= the\ninvalidate_lock rwsem) shared in exactly this path.\n\nTake invalidate_lock shared around iomap_page_mkwrite(). The read-only\nfault path is already covered because filemap_fault() itself grabs\ninvalidate_lock shared on instantiation/read paths; only page_mkwrite\nwas bypassing it in this driver."}], "id": "CVE-2026-99241", "lastModified": "2026-11-02T16:17:49.907", "metrics": {}, "published": "2026-11-02T16:17:49.907", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/0fecc393f2060e6bc25138df32cb923ec7071c6b"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/57c0d5281666d150c73e56e6795a4eef3ede8693"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: kernel: Denial of Service via race condition in NTFS driver", "id": "2565257", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2565257"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-366", "details": ["A flaw was found in the Linux kernel's NTFS file system driver. A local user can cause a Denial of Service (DoS) or file system corruption by exploiting a race condition between concurrent memory-mapped write operations and file truncation or allocation. Because the driver omits proper synchronization locks when handling write page faults, concurrent operations can invalidate memory mappings prematurely and lead to a system crash."], "name": "CVE-2026-99241", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:5", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-10", "product_name": "Red Hat OpenShift Container Platform 5"}, {"cpe": "cpe:/a:redhat:openshift:5", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 5"}], "public_date": "2026-11-02T16:06:44Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-99241\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-99241\nhttps://git.kernel.org/stable/c/0fecc393f2060e6bc25138df32cb923ec7071c6b\nhttps://git.kernel.org/stable/c/57c0d5281666d150c73e56e6795a4eef3ede8693"], "statement": "This vulnerability is rated as Moderate impact because exploitation requires local access and write permissions on an active NTFS mount, and the resulting impact is confined to a local denial of service or filesystem corruption without code execution. In typical Red Hat Enterprise Linux deployments, NTFS is neither mounted by default nor used for system partitions, significantly restricting exposure. An attacker must execute carefully timed concurrent memory-mapped writes and file allocation or truncation calls on an existing NTFS filesystem to trigger the race.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[9c87959601e80b39a45250e362e6ddfec17cb0fa,57c0d5281666d150c73e56e6795a4eef3ede8693)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[9c87959601e80b39a45250e362e6ddfec17cb0fa,0fecc393f2060e6bc25138df32cb923ec7071c6b)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "7.1"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,7.1)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.14,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3,*]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[9c87959601e80b39a45250e362e6ddfec17cb0fa,57c0d5281666d150c73e56e6795a4eef3ede8693)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[9c87959601e80b39a45250e362e6ddfec17cb0fa,0fecc393f2060e6bc25138df32cb923ec7071c6b)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "7.1"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,7.1)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.14,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3,*]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-11-02T18:00:17.275010+00:00", "updated": "2026-11-05T04:30:11.113857+00:00", "vendors": ["linux", "linux$PRODUCT$linux", "linux$PRODUCT$linux_kernel"]}