{"id":"CVE-2026-99107","kind":"vulnerability","aliases":["CVE-2026-99107"],"related":[],"title":"Linux kernel NTFS driver: wrong MFT record pointer corrupts attribute resizing","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nntfs: fix incorrect MFT record pointer passed to ntfs_attr_record_resize\n\nntfs_new_attr_flags() passes the wrong MFT record to ntfs_attr_record_resize().\nWhen the attribute is in an extent record, ctx->mrec points to the extent\nbut the function receives the base record pointer m, causing incorrect\nsize calculations in memmove.\n\nFix by passing ctx->mrec (the actual MFT record containing the attribute)\ninstead of m (the base MFT record) to ntfs_attr_record_resize().","summary":"The Linux kernel's NTFS driver passes the base MFT record instead of the extent record when creating an attribute stored in an extent record, so size calculations in memmove are wrong. The sources do not state a concrete attacker outcome beyond this memory-handling error.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","linux-kernel","ntfs","self-hosted"],"not_affected_if":["no-ntfs-mounts"],"how_to_check":"- unknown","fix":"- Update the Linux kernel to a release that includes the upstream commit fixing ntfs_new_attr_flags() (version unknown from sources)","status":"open","published_at":"2026-10-28T11:17:30+00:00","first_seen_at":"2026-10-28T11:32:34+00:00","triaged_at":"2026-10-28T11:37:47+00:00","updated_at":"2026-10-28T11:37:47+00:00","category":"infrastructure","confidence":0.4,"triage":{"at":"2026-10-28T11:37:47Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Linux kernel to a release that includes the upstream commit fixing ntfs_new_attr_flags() (version unknown from sources)","reach":"local","title":"Linux kernel NTFS driver: wrong MFT record pointer corrupts attribute resizing","impact":"medium","summary":"The Linux kernel's NTFS driver passes the base MFT record instead of the extent record when creating an attribute stored in an extent record, so size calculations in memmove are wrong. The sources do not state a concrete attacker outcome beyond this memory-handling error.","category":"infrastructure","nicknames":[],"who_cares":["linux-kernel","ntfs","self-hosted"],"confidence":0.4,"needs_auth":"unknown","worst_case":"unknown memory corruption in kernel NTFS driver, impact not stated","analyst_note":"Check the NVD entry and the linked upstream kernel commit for affected version ranges, fixed kernel versions and whether attacker-controlled NTFS images can trigger the bug.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":["no-ntfs-mounts"],"who_is_affected":"Systems running a Linux kernel with the ntfs driver loaded that mount or write NTFS volumes with extended MFT records. The sources do not say which kernel versions are affected or whether untrusted NTFS images trigger it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000603,"input_tokens":3421,"output_tokens":521,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-99107':14A,17A 'actual':144C 'attack':65B 'attr':92C,97C,106C,159C 'attribut':10A,45B,111C,149C 'base':34B,128C,154C 'beyond':67B 'calcul':53B,135C 'caus':132C 'concret':64B 'contain':147C 'corrupt':9A 'creat':43B 'ctx':117C,141C 'cve':12A,15A 'driver':4A,31B 'error':72B 'extent':40B,49B,115C,122C 'fix':84C,138C 'flag':98C 'follow':78C 'function':125C 'handl':71B 'host':25B 'incorrect':85C,133C 'infrastructur':18B 'instead':37B,150C 'kernel':2A,21B,28B,76C 'linux':1A,20B,27B,75C 'linux-kernel':19B 'm':131C,152C 'memmov':55B,137C 'memori':70B 'memory-handl':69B 'mft':6A,35B,86C,102C,145C,155C 'mrec':118C,142C 'new':96C 'ntfs':3A,22B,30B,83C,91C,95C,105C,158C 'outcom':66B 'pass':32B,89C,99C,140C 'point':119C 'pointer':8A,88C,130C 'receiv':126C 'record':7A,36B,41B,50B,87C,93C,103C,107C,116C,129C,146C,156C,160C 'resiz':11A,94C,108C,161C 'resolv':82C 'self':24B 'self-host':23B 'size':52B,134C 'sourc':59B 'state':62B 'store':46B 'vulner':79C 'wrong':5A,57B,101C","nicknames":[],"mitigations":[],"who_affected":"Systems running a Linux kernel with the ntfs driver loaded that mount or write NTFS volumes with extended MFT records. The sources do not say which kernel versions are affected or whether untrusted NTFS images trigger it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T11:17:30+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-99107","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-99107","severity":null,"published_at":"2026-10-28T11:17:30+00:00","modified_at":"2026-10-28T11:17:30+00:00","first_seen_at":"2026-10-28T11:32:34+00:00","fetched_at":"2026-10-28T11:32:34+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}