CVE-2026-99242

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-99242", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.403Z", "datePublished": "2026-11-02T16:06:44.590Z", "dateUpdated": "2026-11-02T16:06:44.590Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-11-02T16:06:44.590Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nntfs: fix race between fallocate and mmap reads\n\nThe fallocate implementation only takes invalidate_lock for punch hole,\ncollapse range, and insert range operations. For standard allocation modes\n(mode == 0, FALLOC_FL_KEEP_SIZE), the lock is not held.\n\nDuring ntfs_attr_fallocate(), new clusters are mapped to the runlist via\nntfs_attr_map_cluster() before being zeroed by ntfs_dio_zero_range(). This\ncreates a window where concurrent mmap page faults can read uninitialized\ndisk data.\n\nSince mmap uses filemap_fault() which takes invalidate_lock in shared mode,\nit can fault in pages during this window and expose old disk contents to\nuserspace. This is an information leak and data integrity issue.\n\nFix by taking invalidate_lock for all fallocate operations, not just for\npunch/collapse/insert modes. This prevents concurrent page faults from\naccessing unzeroed clusters during the allocation window."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/ntfs/file.c"], "versions": [{"version": "495e90fa334828d4119061e2726af51d0a0fb4ed", "lessThan": "7dd1c2fec6ebdd1a88a02cb58ff515a258eeb327", "status": "affected", "versionType": "git"}, {"version": "495e90fa334828d4119061e2726af51d0a0fb4ed", "lessThan": "67aded1da114dc44808315f249bd9e7e440f799d", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/ntfs/file.c"], "versions": [{"version": "7.1", "status": "affected"}, {"version": "0", "lessThan": "7.1", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.14", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "7.1", "versionEndExcluding": "7.2.14"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "7.1", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/7dd1c2fec6ebdd1a88a02cb58ff515a258eeb327"}, {"url": "https://git.kernel.org/stable/c/67aded1da114dc44808315f249bd9e7e440f799d"}], "title": "ntfs: fix race between fallocate and mmap reads", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["fs/ntfs/file.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "7dd1c2fec6ebdd1a88a02cb58ff515a258eeb327", "status": "affected", "version": "495e90fa334828d4119061e2726af51d0a0fb4ed", "versionType": "git"}, {"lessThan": "67aded1da114dc44808315f249bd9e7e440f799d", "status": "affected", "version": "495e90fa334828d4119061e2726af51d0a0fb4ed", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["fs/ntfs/file.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "7.1"}, {"lessThan": "7.1", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.14", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nntfs: fix race between fallocate and mmap reads\n\nThe fallocate implementation only takes invalidate_lock for punch hole,\ncollapse range, and insert range operations. For standard allocation modes\n(mode == 0, FALLOC_FL_KEEP_SIZE), the lock is not held.\n\nDuring ntfs_attr_fallocate(), new clusters are mapped to the runlist via\nntfs_attr_map_cluster() before being zeroed by ntfs_dio_zero_range(). This\ncreates a window where concurrent mmap page faults can read uninitialized\ndisk data.\n\nSince mmap uses filemap_fault() which takes invalidate_lock in shared mode,\nit can fault in pages during this window and expose old disk contents to\nuserspace. This is an information leak and data integrity issue.\n\nFix by taking invalidate_lock for all fallocate operations, not just for\npunch/collapse/insert modes. This prevents concurrent page faults from\naccessing unzeroed clusters during the allocation window."}], "id": "CVE-2026-99242", "lastModified": "2026-11-02T16:17:50.040", "metrics": {}, "published": "2026-11-02T16:17:50.040", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/67aded1da114dc44808315f249bd9e7e440f799d"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/7dd1c2fec6ebdd1a88a02cb58ff515a258eeb327"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: kernel: Information disclosure via race condition between fallocate and mmap reads in NTFS", "id": "2565273", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2565273"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "status": "draft"}, "cwe": "CWE-413", "details": ["A flaw was found in the Linux kernel's NTFS file system implementation. A race condition between file space preallocation and memory-mapped file operations allows newly allocated storage blocks to be accessed before they are cleared. A local user can exploit this vulnerability by reading memory-mapped files during concurrent space allocation, leading to information disclosure of stale or uninitialized disk data."], "name": "CVE-2026-99242", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:5", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-10", "product_name": "Red Hat OpenShift Container Platform 5"}, {"cpe": "cpe:/a:redhat:openshift:5", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 5"}], "public_date": "2026-11-02T16:06:44Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-99242\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-99242\nhttps://git.kernel.org/stable/c/67aded1da114dc44808315f249bd9e7e440f799d\nhttps://git.kernel.org/stable/c/7dd1c2fec6ebdd1a88a02cb58ff515a258eeb327"], "statement": "This vulnerability is rated as Moderate impact for Red Hat products because exploitation requires existing local user access and permissions to write to an NTFS-formatted filesystem. Red Hat Enterprise Linux does not deploy NTFS as a primary filesystem, generally restricting its presence to optional removable media or secondary partitions. The flaw allows the disclosure of stale or uninitialized storage blocks during concurrent allocation operations, but does not provide privileges to execute arbitrary code or compromise system availability.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[495e90fa334828d4119061e2726af51d0a0fb4ed,7dd1c2fec6ebdd1a88a02cb58ff515a258eeb327)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[495e90fa334828d4119061e2726af51d0a0fb4ed,67aded1da114dc44808315f249bd9e7e440f799d)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "7.1"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,7.1)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.14,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3,*]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[495e90fa334828d4119061e2726af51d0a0fb4ed,7dd1c2fec6ebdd1a88a02cb58ff515a258eeb327)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[495e90fa334828d4119061e2726af51d0a0fb4ed,67aded1da114dc44808315f249bd9e7e440f799d)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "7.1"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,7.1)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.14,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3,*]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-11-02T18:00:17.274770+00:00", "updated": "2026-11-05T04:15:05.069700+00:00", "vendors": ["linux", "linux$PRODUCT$linux", "linux$PRODUCT$linux_kernel"]}