---
id: "CVE-2026-99107"
kind: "vulnerability"
aliases: ["CVE-2026-99107"]
title: "Linux kernel NTFS driver: wrong MFT record pointer corrupts attribute resizing"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["infrastructure", "linux-kernel", "ntfs", "self-hosted"]
not_affected_if: ["no-ntfs-mounts"]
published_at: "2026-10-28T11:17:30+00:00"
first_seen_at: "2026-10-28T11:32:34+00:00"
updated_at: "2026-10-28T11:37:47+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-99107", "first_seen_at": "2026-10-28T11:32:34+00:00"}]
---

# Linux kernel NTFS driver: wrong MFT record pointer corrupts attribute resizing

The Linux kernel's NTFS driver passes the base MFT record instead of the extent record when creating an attribute stored in an extent record, so size calculations in memmove are wrong. The sources do not state a concrete attacker outcome beyond this memory-handling error.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- unknown

## Fix

- Update the Linux kernel to a release that includes the upstream commit fixing ntfs_new_attr_flags() (version unknown from sources)

## Timeline

- 2026-10-28T11:32:34+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-99107

## From the sources

In the Linux kernel, the following vulnerability has been resolved:

ntfs: fix incorrect MFT record pointer passed to ntfs_attr_record_resize

ntfs_new_attr_flags() passes the wrong MFT record to ntfs_attr_record_resize().
When the attribute is in an extent record, ctx->mrec points to the extent
but the function receives the base record pointer m, causing incorrect
size calculations in memmove.

Fix by passing ctx->mrec (the actual MFT record containing the attribute)
instead of m (the base MFT record) to ntfs_attr_record_resize().

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_