---
id: "CVE-2026-99102"
kind: "vulnerability"
aliases: ["CVE-2026-99102"]
title: "Linux kernel NTFS driver: size change races page faults, causing spurious SIGBUS"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["infrastructure", "kernel", "linux", "ntfs"]
not_affected_if: []
published_at: "2026-10-28T11:17:29+00:00"
first_seen_at: "2026-10-28T11:32:34+00:00"
updated_at: "2026-10-28T11:37:53+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-99102", "first_seen_at": "2026-10-28T11:32:34+00:00"}]
---

# Linux kernel NTFS driver: size change races page faults, causing spurious SIGBUS

The Linux kernel's NTFS driver resizes files without holding the invalidate_lock, so a page fault during the resize can fail with a spurious SIGBUS. The sources describe a race condition that crashes or fails memory-mapped access rather than a clearly described code-execution path.

_Summary, check and fix written by a model from the sources; labelled as such._

## Timeline

- 2026-10-28T11:32:34+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-99102

## From the sources

In the Linux kernel, the following vulnerability has been resolved:

ntfs: take invalidate_lock in ntfs_setattr_size()

ntfs_setattr_size() updates i_size and resizes the on-disk attribute
without holding mapping->invalidate_lock.  Page faults take the lock
shared, so a fault racing the resize can resolve a VCN against the
transient runlist state of ntfs_non_resident_attr_expand() and fail
with a spurious SIGBUS, and can interleave with the size-change
epilogue (truncate_pagecache(), i_size_write(),
pagecache_isize_extended()).

Take invalidate_lock exclusively around the whole resize after
inode_dio_wait(), matching the fallocate path and other filesystems
such as xfs, which wraps truncate in its mmaplock (= invalidate_lock).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_