{"id":"CVE-2026-98880","kind":"vulnerability","aliases":["CVE-2026-98880"],"related":[],"title":"Linux kernel ntfs3: unhandled set_blocksize failure crashes NTFS mounts","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nntfs3: handle set_blocksize failures\n\nntfs3 uses buffer_heads, which don't handle block size > PAGE_SIZE well.\nWithout this, mounting we will hit the\n\n        BUG_ON(offset >= folio_size(folio));\n\nin folio_set_bh on the first __bread_gfp call.","summary":"In the Linux kernel's ntfs3 driver, a failed set_blocksize call is not handled, so mounting an NTFS volume with a block size larger than the page size hits a kernel BUG_ON. The sources describe a kernel crash on mount rather than any data access or code execution.","severity":"unknown","cvss":null,"epss":0.00209,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","kernel","linux","ntfs3","self-hosted"],"not_affected_if":["no-ntfs3-mounts","ntfs-3g-only"],"how_to_check":"- `uname -r` to see the running kernel version and compare it with the fixed release in the NVD entry\n- `lsmod | grep ntfs3` to check whether the ntfs3 driver is loaded\n- unknown whether any other check is needed; the sources do not say","fix":"- Update the Linux kernel to a release that includes the upstream ntfs3 set_blocksize fix; the exact fixed version is unknown from the sources\n- Until patched, avoid mounting NTFS volumes with the ntfs3 driver if practical","status":"open","published_at":"2026-10-23T12:18:21+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","triaged_at":"2026-10-25T05:00:11+00:00","updated_at":"2026-10-25T12:38:51+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-25T05:00:11Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Linux kernel to a release that includes the upstream ntfs3 set_blocksize fix; the exact fixed version is unknown from the sources\n- Until patched, avoid mounting NTFS volumes with the ntfs3 driver if practical","reach":"local","title":"Linux kernel ntfs3: unhandled set_blocksize failure crashes NTFS mounts","impact":"low","summary":"In the Linux kernel's ntfs3 driver, a failed set_blocksize call is not handled, so mounting an NTFS volume with a block size larger than the page size hits a kernel BUG_ON. The sources describe a kernel crash on mount rather than any data access or code execution.","category":"infrastructure","nicknames":[],"who_cares":["linux","kernel","ntfs3","self-hosted"],"confidence":0.6,"needs_auth":"unknown","worst_case":"kernel BUG_ON crash during NTFS mount, denial of service","analyst_note":"Find the fixed kernel version and the upstream commit in the NVD entry or the kernel stable tree to fill in fix and how_to_check.","how_to_check":"- `uname -r` to see the running kernel version and compare it with the fixed release in the NVD entry\n- `lsmod | grep ntfs3` to check whether the ntfs3 driver is loaded\n- unknown whether any other check is needed; the sources do not say","needs_analyst":true,"not_affected_if":["no-ntfs3-mounts","ntfs-3g-only"],"who_is_affected":"Systems that mount NTFS volumes using the Linux kernel ntfs3 driver are potentially affected, since the crash happens during mount. Systems that do not use ntfs3 (no NTFS mounts, or using another driver such as ntfs-3g through FUSE) are unlikely to be affected. The sources do not state which block sizes or volume types trigger the bug.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000681,"input_tokens":3348,"output_tokens":693,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-98880':13A,16A 'access':70B 'bh':118C 'block':46B,97C 'blocksiz':6A,34B,87C 'bread':122C 'buffer':91C 'bug':56B,109C 'call':35B,124C 'code':72B 'crash':8A,63B 'cve':11A,14A 'data':69B 'describ':60B 'driver':30B 'execut':73B 'fail':32B 'failur':7A,88C 'first':121C 'folio':112C,114C,116C 'follow':79C 'gfp':123C 'handl':38B,85C,96C 'head':92C 'hit':53B,107C 'host':23B 'infrastructur':17B 'kernel':2A,18B,27B,55B,62B,77C 'larger':48B 'linux':1A,19B,26B,76C 'mount':10A,40B,65B,104C 'ntfs':9A,42B 'ntfs3':3A,20B,29B,84C,89C 'offset':111C 'page':51B,99C 'rather':66B 'resolv':83C 'self':22B 'self-host':21B 'set':5A,33B,86C,117C 'size':47B,52B,98C,100C,113C 'sourc':59B 'unhandl':4A 'use':90C 'volum':43B 'vulner':80C 'well':101C 'without':102C","nicknames":[],"mitigations":[],"who_affected":"Systems that mount NTFS volumes using the Linux kernel ntfs3 driver are potentially affected, since the crash happens during mount. Systems that do not use ntfs3 (no NTFS mounts, or using another driver such as ntfs-3g through FUSE) are unlikely to be affected. The sources do not state which block sizes or volume types trigger the bug.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T12:18:21+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98880","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98880","severity":null,"published_at":"2026-10-23T12:18:21+00:00","modified_at":"2026-10-23T12:18:21+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"epss","external_id":"CVE-2026-98880","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-98880","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:51+00:00","fetched_at":"2026-10-25T12:38:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}