Live › vulnerability › CVE-2026-99107
Go to dashboardThe Linux kernel's NTFS driver passes the base MFT record instead of the extent record when creating an attribute stored in an extent record, so size calculations in memmove are wrong. The sources do not state a concrete attacker outcome beyond this memory-handling error.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 11:32 UTC. All times on this page are UTC.
Systems running a Linux kernel with the ntfs driver loaded that mount or write NTFS volumes with extended MFT records. The sources do not say which kernel versions are affected or whether untrusted NTFS images trigger it.
No product ranges from the sources yet.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
ntfs: fix incorrect MFT record pointer passed to ntfs_attr_record_resize
ntfs_new_attr_flags() passes the wrong MFT record to ntfs_attr_record_resize(). When the attribute is in an extent record, ctx->mrec points to the extent but the function receives the base record pointer m, causing incorrect size calculations in memmove.
Fix by passing ctx->mrec (the actual MFT record containing the attribute) instead of m (the base MFT record) to ntfs_attr_record_resize().
This page as .md · .json · in your agent: get_signal("CVE-2026-99107")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.