{"id":"CVE-2026-99241","kind":"vulnerability","aliases":["CVE-2026-99241"],"related":[],"title":"Linux kernel NTFS: write faults race with truncate and fallocate","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nntfs: take invalidate_lock in ntfs_filemap_page_mkwrite()\n\nntfs_filemap_page_mkwrite() calls iomap_page_mkwrite() without holding\nmapping->invalidate_lock, so a concurrent truncate or fallocate can be\nin the middle of invalidating pagecache and rewriting the runlist while\nthe write fault maps blocks and dirties the folio.  This races with\nntfs_attr_fallocate(), which merges clusters into the in-memory\nrunlist, drops the runlist lock, and only afterwards zeroes the newly\nallocated clusters on disk; and with the punch-hole/insert/collapse\npaths that free clusters after truncating the cache.\n\nPer Documentation/filesystems/locking.rst, ->page_mkwrite() must ensure\nthere are no truncate/invalidate races, \"usually mapping->invalidate_lock\nis suitable for proper serialization\".  xfs takes its mmaplock (= the\ninvalidate_lock rwsem) shared in exactly this path.\n\nTake invalidate_lock shared around iomap_page_mkwrite().  The read-only\nfault path is already covered because filemap_fault() itself grabs\ninvalidate_lock shared on instantiation/read paths; only page_mkwrite\nwas bypassing it in this driver.","summary":"The Linux kernel's NTFS driver did not hold the invalidate lock during write-fault handling, so a write could race with a concurrent truncate or fallocate that is rewriting the file's cluster map. The sources do not state a concrete attacker outcome, so the impact is not established beyond a race that can corrupt file state.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["linux-kernel","ntfs","runtime","self-hosted"],"not_affected_if":["no-ntfs-mounts"],"how_to_check":"- Check whether the kernel is built with or loads the `ntfs` driver (NTFS, not ntfs3) with `lsmod | grep ntfs` or `grep -i ntfs /proc/filesystems`\n- Check the running kernel version with `uname -r` and compare it to the fixed release in the kernel's stable branch","fix":null,"status":"open","published_at":"2026-11-02T16:17:49+00:00","first_seen_at":"2026-11-02T16:24:06+00:00","triaged_at":"2026-11-02T16:26:49+00:00","updated_at":"2026-11-02T16:26:49+00:00","category":"runtime","confidence":0.4,"triage":{"at":"2026-11-02T16:26:49Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Linux kernel NTFS: write faults race with truncate and fallocate","impact":"low","summary":"The Linux kernel's NTFS driver did not hold the invalidate lock during write-fault handling, so a write could race with a concurrent truncate or fallocate that is rewriting the file's cluster map. The sources do not state a concrete attacker outcome, so the impact is not established beyond a race that can corrupt file state.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["linux-kernel","ntfs","self-hosted"],"confidence":0.4,"fix_status":"unknown","needs_auth":"unknown","worst_case":"unknown; a race in file handling that may corrupt data","analyst_note":"Confirm affected kernel version ranges and the fixed commit from the NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-99241) and the upstream kernel stable tree, and whether any local or remote trigger exists.","how_to_check":"- Check whether the kernel is built with or loads the `ntfs` driver (NTFS, not ntfs3) with `lsmod | grep ntfs` or `grep -i ntfs /proc/filesystems`\n- Check the running kernel version with `uname -r` and compare it to the fixed release in the kernel's stable branch\n- unknown","plain_action":"","needs_analyst":true,"not_affected_if":["no-ntfs-mounts"],"who_is_affected":"Only systems that mount NTFS volumes through the in-kernel `ntfs` driver and let concurrent writes, truncates or fallocate calls hit the same mapped file can hit the race. The sources do not say which kernel versions are affected or whether an attacker without local access can trigger it. Systems that do not mount NTFS can skip it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000783,"input_tokens":4478,"output_tokens":671,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-99241':13A,16A '/insert/collapse':179C 'afterward':165C 'alloc':169C 'alreadi':236C 'around':225C 'attack':68B 'attr':148C 'beyond':76B 'block':139C 'bypass':253C 'cach':187C 'call':107C 'cluster':59B,152C,170C,183C 'concret':67B 'concurr':49B,118C 'corrupt':81B 'could':45B 'cover':237C 'cve':11A,14A 'dirti':141C 'disk':172C 'documentation/filesystems/locking.rst':189C 'driver':30B,257C 'drop':159C 'ensur':193C 'establish':75B 'exact':218C 'falloc':10A,52B,121C,149C 'fault':5A,40B,137C,233C,240C 'file':57B,82B 'filemap':100C,104C,239C 'folio':143C 'follow':89C 'free':182C 'grab':242C 'handl':41B 'hold':33B,112C 'hole':178C 'host':24B 'impact':72B 'in-memori':155C 'instantiation/read':247C 'invalid':35B,96C,114C,128C,201C,213C,222C,243C 'iomap':108C,226C 'kernel':2A,19B,27B,87C 'linux':1A,18B,26B,86C 'linux-kernel':17B 'lock':36B,97C,115C,162C,202C,214C,223C,244C 'map':60B,113C,138C,200C 'memori':157C 'merg':151C 'middl':126C 'mkwrite':102C,106C,110C,191C,228C,251C 'mmaplock':211C 'must':192C 'newli':168C 'ntfs':3A,20B,29B,94C,99C,103C,147C 'outcom':69B 'page':101C,105C,109C,190C,227C,250C 'pagecach':129C 'path':180C,220C,234C,248C 'per':188C 'proper':206C 'punch':177C 'punch-hol':176C 'race':6A,46B,78B,145C,198C 'read':231C 'read-on':230C 'resolv':93C 'rewrit':55B,131C 'runlist':133C,158C,161C 'runtim':21B 'rwsem':215C 'self':23B 'self-host':22B 'serial':207C 'share':216C,224C,245C 'sourc':62B 'state':65B,83B 'suitabl':204C 'take':95C,209C,221C 'truncat':8A,50B,119C,185C 'truncate/invalidate':197C 'usual':199C 'vulner':90C 'without':111C 'write':4A,39B,44B,136C 'write-fault':38B 'xfs':208C 'zero':166C","nicknames":[],"mitigations":[],"who_affected":"Only systems that mount NTFS volumes through the in-kernel `ntfs` driver and let concurrent writes, truncates or fallocate calls hit the same mapped file can hit the race. The sources do not say which kernel versions are affected or whether an attacker without local access can trigger it. Systems that do not mount NTFS can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["linuxkernel","ntfs","runtime","selfhosted","unknown"],"first_public_at":"2026-11-02T16:17:49+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-99241","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-99241","severity":null,"published_at":"2026-11-02T16:17:49+00:00","modified_at":"2026-11-02T16:17:49+00:00","first_seen_at":"2026-11-02T16:24:06+00:00","fetched_at":"2026-11-02T16:24:06+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}