{"id":"CVE-2026-99101","kind":"vulnerability","aliases":["CVE-2026-99101"],"related":[],"title":"Linux kernel NTFS: attribute move corrupts mapping pairs when compression toggles","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nntfs: move attribute payload before shrinking its record\n\nntfs_new_attr_flags() resizes the non-resident attribute record before\nmoving its name and mapping pairs to their shorter-header offsets when\ncompression or sparse state is cleared.\n\nShrinking the record first moves the following attribute over the tail of\nthe old record. The subsequent memmove() therefore copies bytes from that\nfollowing attribute instead of the old mapping pairs. Re-enabling\ncompression on an empty file persists those bytes as a malformed mapping\npairs array, which ntfsck reports as a missing or invalid run length.\n\nMove the payload before shrinking the record, while retaining the existing\nresize-before-move ordering when growing it.","summary":"When the Linux kernel's NTFS driver clears compression or sparse state on a file, it resizes the attribute record before moving its payload, so the following attribute's bytes get copied into the mapping pairs. Re-enabling compression on an empty file then writes a malformed mapping pairs array to disk that ntfsck reports as a bad run length.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["kernel","linux","ntfs","runtime"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-28T11:17:29+00:00","first_seen_at":"2026-10-28T11:32:34+00:00","triaged_at":"2026-10-28T11:37:53+00:00","updated_at":"2026-10-28T11:37:53+00:00","category":"runtime","confidence":0.5,"triage":{"at":"2026-10-28T11:37:53Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Linux kernel NTFS: attribute move corrupts mapping pairs when compression toggles","impact":"low","summary":"When the Linux kernel's NTFS driver clears compression or sparse state on a file, it resizes the attribute record before moving its payload, so the following attribute's bytes get copied into the mapping pairs. Re-enabling compression on an empty file then writes a malformed mapping pairs array to disk that ntfsck reports as a bad run length.","category":"runtime","nicknames":[],"who_cares":["linux","ntfs","kernel"],"confidence":0.5,"needs_auth":"unknown","worst_case":"unknown; sources describe on-disk NTFS metadata corruption","analyst_note":"Sources give only the kernel commit text; check the upstream fix commit and the kernel stable release notes for affected and fixed versions.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000542,"input_tokens":3466,"output_tokens":390,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-99101':14A,17A 'array':72B,179C 'attr':103C 'attribut':4A,40B,49B,95C,110C,139C,156C 'bad':80B 'byte':51B,152C,173C 'clear':29B,131C 'compress':10A,30B,61B,126C,166C 'copi':53B,151C 'corrupt':6A 'cve':12A,15A 'disk':74B 'driver':28B 'empti':64B,169C 'enabl':60B,165C 'exist':200C 'file':36B,65B,170C 'first':135C 'flag':104C 'follow':48B,88C,138C,155C 'get':52B 'grow':207C 'header':123C 'instead':157C 'invalid':187C 'kernel':2A,18B,25B,86C 'length':82B,189C 'linux':1A,19B,24B,85C 'malform':69B,176C 'map':7A,56B,70B,117C,161C,177C 'memmov':149C 'miss':185C 'move':5A,43B,94C,113C,136C,190C,204C 'name':115C 'new':102C 'non':108C 'non-resid':107C 'ntfs':3A,20B,27B,93C,101C 'ntfsck':76B,181C 'offset':124C 'old':145C,160C 'order':205C 'pair':8A,57B,71B,118C,162C,178C 'payload':45B,96C,192C 'persist':171C 're':59B,164C 're-en':58B,163C 'record':41B,100C,111C,134C,146C,196C 'report':77B,182C 'resid':109C 'resiz':38B,105C,202C 'resize-before-mov':201C 'resolv':92C 'retain':198C 'run':81B,188C 'runtim':21B 'shorter':122C 'shorter-head':121C 'shrink':98C,132C,194C 'spars':32B,128C 'state':33B,129C 'subsequ':148C 'tail':142C 'therefor':150C 'toggl':11A 'vulner':89C 'write':67B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T11:17:29+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-99101","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-99101","severity":null,"published_at":"2026-10-28T11:17:29+00:00","modified_at":"2026-10-28T11:17:29+00:00","first_seen_at":"2026-10-28T11:32:34+00:00","fetched_at":"2026-10-28T11:32:34+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}