{"id":"CVE-2026-99171","kind":"vulnerability","aliases":["CVE-2026-99171"],"related":[],"title":"Linux kernel ntfs3: use-after-free in filename lookup after unmount","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nntfs3: free the sbi after a grace period\n\nIf the \"nocase\" mount option ntfs3 uses custom hash and dentry compare\nfunctions. Both access ntfs3 superblock private information in rcu\npathwalk. ntfs_put_super() and ntfs3_kill_sb() drop the info without any\nrcu delay. A lookup that's still inside the filesystem when the last\nreference to the mount is dropped causes a UAF. With a pathwalk held up\nin ntfs_d_hash() while the last reference to the mount goes away:\n\n  BUG: KASAN: slab-use-after-free in ntfs_nls_to_utf16+0x752/0x940\n  Read of size 8 at addr ff1100010453c850 by task walker/99\n  Call Trace:\n   <TASK>\n   ntfs_nls_to_utf16+0x752/0x940\n   ntfs_d_hash+0x22b/0x500\n   link_path_walk+0x11ad/0x1d30\n   path_lookupat+0x63/0xb00\n   filename_lookup+0x1f1/0x5b0\n   vfs_statx+0xd7/0x3b0\n  [...]\n  Allocated by task 95:\n   __kmalloc_cache_noprof+0x249/0x560\n   ntfs_init_fs_context+0x2db/0x5a0\n   alloc_fs_context+0x52e/0xc70\n  [...]\n  Freed by task 98:\n   kfree+0x1db/0x5b0\n   deactivate_locked_super+0x9c/0xf0\n   cleanup_mnt+0x9f/0x130\n   task_work_run+0x131/0x250\n\nThe bug is currently masked by the grace period in namespace_unlock()\nfor umount(2). Keep the necessary information until the filesystem\nprivate info is freed and free it with an rcu delay.\n\nntfs3_free_sbi() now runs from an rcu callback and drops the upcase\ntable via ntfs_put_shared(). So switch s_shared_lock over to\nspin_lock_bh(). Otherwise the callback can deadlock against a task\nholding the lock on the same cpu.","summary":"The ntfs3 driver in the Linux kernel frees its superblock private data too early when a mount with the nocase option is unmounted during an RCU path walk. A concurrent file lookup can then read freed memory, which can crash the kernel or be turned into further compromise.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["linux-kernel","ntfs3","other","self-hosted"],"not_affected_if":["default-config","no-ntfs3-mounts"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-28T11:17:37+00:00","first_seen_at":"2026-10-28T11:32:36+00:00","triaged_at":"2026-10-28T11:35:38+00:00","updated_at":"2026-10-28T11:35:38+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-10-28T11:35:38Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Linux kernel ntfs3: use-after-free in filename lookup after unmount","impact":"high","summary":"The ntfs3 driver in the Linux kernel frees its superblock private data too early when a mount with the nocase option is unmounted during an RCU path walk. A concurrent file lookup can then read freed memory, which can crash the kernel or be turned into further compromise.","category":"other","nicknames":[],"who_cares":["linux-kernel","ntfs3","self-hosted"],"confidence":0.6,"needs_auth":"unknown","worst_case":"kernel memory read after free; possible crash or privilege escalation","analyst_note":"Check the upstream kernel stable commit and NVD entry for affected kernel version ranges and the fixed stable release.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["no-ntfs3-mounts","default-config"],"who_is_affected":"Systems that mount NTFS volumes with the ntfs3 driver and the nocase mount option are the ones exposed, since that option enables the custom hash and compare functions where the bug sits. Hosts that do not mount NTFS with ntfs3, or that never use nocase, are not affected by this path.","user_interaction":"unknown","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000629,"input_tokens":3942,"output_tokens":469,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'+0':179C,197C,202C,207C,211C,215C,219C,228C,234C,239C,246C,251C,255C,260C '-2026':14A,17A '-99171':15A,18A '2':276C '8':184C '95':224C '98':244C 'access':107C 'addr':186C 'alloc':221C,236C 'away':166C 'bh':322C 'bug':167C,263C 'cach':226C 'call':191C 'callback':303C,325C 'caus':146C 'cleanup':253C 'compar':104C 'compromis':74B 'concurr':56B 'context':233C,238C 'cpu':337C 'crash':66B 'current':265C 'custom':100C 'cve':13A,16A 'd':156C,200C 'data':38B 'deactiv':248C 'deadlock':327C 'delay':128C,294C 'dentri':103C 'driver':29B 'drop':122C,145C,305C 'earli':40B 'ff1100010453c850':187C 'file':57B 'filenam':9A,213C 'filesystem':136C,283C 'follow':80C 'free':7A,34B,86C,173C,289C,296C 'freed':62B,241C,287C 'fs':232C,237C 'function':105C 'goe':165C 'grace':91C,269C 'hash':101C,157C,201C 'held':152C 'hold':331C 'host':26B 'info':124C,285C 'inform':111C,280C 'init':231C 'insid':134C 'kasan':168C 'keep':277C 'kernel':2A,21B,33B,68B,78C 'kfree':245C 'kill':120C 'kmalloc':225C 'last':139C,160C 'link':204C 'linux':1A,20B,32B,77C 'linux-kernel':19B 'lock':249C,317C,321C,333C 'lookup':10A,58B,130C,214C 'lookupat':210C 'mask':266C 'memori':63B 'mnt':254C 'mount':43B,96C,143C,164C 'namespac':272C 'necessari':279C 'nls':176C,194C 'nocas':46B,95C 'noprof':227C 'ntfs':115C,155C,175C,193C,199C,230C,310C 'ntfs3':3A,22B,28B,85C,98C,108C,119C,295C 'option':47B,97C 'otherwis':323C 'path':53B,205C,209C 'pathwalk':114C,151C 'period':92C,270C 'privat':37B,110C,284C 'put':116C,311C 'rcu':52B,113C,127C,293C,302C 'read':61B,181C 'refer':140C,161C 'resolv':84C 'run':259C,299C 'sb':121C 'sbi':88C,297C 'self':25B 'self-host':24B 'share':312C,316C 'size':183C 'slab':170C 'slab-use-after-fre':169C 'spin':320C 'statx':218C 'still':133C 'super':117C,250C 'superblock':36B,109C 'switch':314C 'tabl':308C 'task':189C,223C,243C,257C,330C 'trace':192C 'turn':71B 'uaf':148C 'umount':275C 'unlock':273C 'unmount':12A,49B 'upcas':307C 'use':5A,99C,171C 'use-after-fre':4A 'utf16':178C,196C 'vfs':217C 'via':309C 'vulner':81C 'walk':54B,206C 'walker/99':190C 'without':125C 'work':258C 'x11ad/0x1d30':208C 'x131/0x250':261C 'x1db/0x5b0':247C 'x1f1/0x5b0':216C 'x22b/0x500':203C 'x249/0x560':229C 'x2db/0x5a0':235C 'x52e/0xc70':240C 'x63/0xb00':212C 'x752/0x940':180C,198C 'x9c/0xf0':252C 'x9f/0x130':256C 'xd7/0x3b0':220C","nicknames":[],"mitigations":[],"who_affected":"Systems that mount NTFS volumes with the ntfs3 driver and the nocase mount option are the ones exposed, since that option enables the custom hash and compare functions where the bug sits. Hosts that do not mount NTFS with ntfs3, or that never use nocase, are not affected by this path.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T11:17:37+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-99171","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-99171","severity":null,"published_at":"2026-10-28T11:17:37+00:00","modified_at":"2026-10-28T11:17:37+00:00","first_seen_at":"2026-10-28T11:32:36+00:00","fetched_at":"2026-10-28T11:32:36+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}