{"id":"CVE-2026-99102","kind":"vulnerability","aliases":["CVE-2026-99102"],"related":[],"title":"Linux kernel NTFS driver: size change races page faults, causing spurious SIGBUS","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nntfs: take invalidate_lock in ntfs_setattr_size()\n\nntfs_setattr_size() updates i_size and resizes the on-disk attribute\nwithout holding mapping->invalidate_lock.  Page faults take the lock\nshared, so a fault racing the resize can resolve a VCN against the\ntransient runlist state of ntfs_non_resident_attr_expand() and fail\nwith a spurious SIGBUS, and can interleave with the size-change\nepilogue (truncate_pagecache(), i_size_write(),\npagecache_isize_extended()).\n\nTake invalidate_lock exclusively around the whole resize after\ninode_dio_wait(), matching the fallocate path and other filesystems\nsuch as xfs, which wraps truncate in its mmaplock (= invalidate_lock).","summary":"The Linux kernel's NTFS driver resizes files without holding the invalidate_lock, so a page fault during the resize can fail with a spurious SIGBUS. The sources describe a race condition that crashes or fails memory-mapped access rather than a clearly described code-execution path.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","kernel","linux","ntfs"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-28T11:17:29+00:00","first_seen_at":"2026-10-28T11:32:34+00:00","triaged_at":"2026-10-28T11:37:53+00:00","updated_at":"2026-10-28T11:37:53+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-10-28T11:37:53Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Linux kernel NTFS driver: size change races page faults, causing spurious SIGBUS","impact":"low","summary":"The Linux kernel's NTFS driver resizes files without holding the invalidate_lock, so a page fault during the resize can fail with a spurious SIGBUS. The sources describe a race condition that crashes or fails memory-mapped access rather than a clearly described code-execution path.","category":"infrastructure","nicknames":[],"who_cares":["linux","kernel","ntfs"],"confidence":0.5,"needs_auth":"unknown","worst_case":"spurious SIGBUS on memory-mapped NTFS file access","analyst_note":"Check the kernel.org stable commit and the NVD entry for fixed kernel versions and whether NTFS mounts with mmap access are reachable by untrusted users.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000542,"input_tokens":3497,"output_tokens":384,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-99102':15A,18A 'access':62B 'around':162C 'attr':133C 'attribut':102C 'caus':10A 'chang':6A,148C 'clear':66B 'code':69B 'code-execut':68B 'condit':54B 'crash':56B 'cve':13A,16A 'describ':51B,67B 'dio':168C 'disk':101C 'driver':4A,28B 'epilogu':149C 'exclus':161C 'execut':70B 'expand':134C 'extend':157C 'fail':44B,58B,136C 'falloc':172C 'fault':9A,39B,109C,116C 'file':30B 'filesystem':176C 'follow':77C 'hold':32B,104C 'infrastructur':19B 'inod':167C 'interleav':143C 'invalid':34B,84C,106C,159C,186C 'isiz':156C 'kernel':2A,20B,25B,75C 'linux':1A,21B,24B,74C 'lock':35B,85C,107C,112C,160C,187C 'map':61B,105C 'match':170C 'memori':60B 'memory-map':59B 'mmaplock':185C 'non':131C 'ntfs':3A,22B,27B,82C,87C,90C,130C 'on-disk':99C 'page':8A,38B,108C 'pagecach':151C,155C 'path':71B,173C 'race':7A,53B,117C 'rather':63B 'resid':132C 'resiz':29B,42B,97C,119C,165C 'resolv':81C,121C 'runlist':127C 'setattr':88C,91C 'share':113C 'sigbus':12A,48B,140C 'size':5A,89C,92C,95C,147C,153C 'size-chang':146C 'sourc':50B 'spurious':11A,47B,139C 'state':128C 'take':83C,110C,158C 'transient':126C 'truncat':150C,182C 'updat':93C 'vcn':123C 'vulner':78C 'wait':169C 'whole':164C 'without':31B,103C 'wrap':181C 'write':154C 'xfs':179C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T11:17:29+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-99102","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-99102","severity":null,"published_at":"2026-10-28T11:17:29+00:00","modified_at":"2026-10-28T11:17:29+00:00","first_seen_at":"2026-10-28T11:32:34+00:00","fetched_at":"2026-10-28T11:32:34+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}