Live › vulnerability › CVE-2026-99242
In the Linux kernel's NTFS driver, fallocate allocates clusters before zeroing them, and a concurrent mmap page fault in that window can read old disk contents. An attacker who can use a mounted NTFS volume with mmap access could read leftover data from previously freed disk blocks.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-02 16:24 UTC. All times on this page are UTC.
Only systems that mount NTFS volumes through the Linux kernel's ntfs driver and let untrusted users or processes use mmap on those files are plausibly exposed. Systems that do not mount NTFS, or that use only trusted local users, can likely skip it. The sources do not give affected version ranges.
No product ranges from the sources yet.
lsmod | grep ntfsuname -r and compare against the fixed release in the kernel stable branchUnknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
ntfs: fix race between fallocate and mmap reads
The fallocate implementation only takes invalidate_lock for punch hole, collapse range, and insert range operations. For standard allocation modes (mode == 0, FALLOC_FL_KEEP_SIZE), the lock is not held.
During ntfs_attr_fallocate(), new clusters are mapped to the runlist via ntfs_attr_map_cluster() before being zeroed by ntfs_dio_zero_range(). This creates a window where concurrent mmap page faults can read uninitialized disk data.
Since mmap uses filemap_fault() which takes invalidate_lock in shared mode, it can fault in pages during this window and expose old disk contents to userspace. This is an information leak and data integrity issue.
Fix by taking invalidate_lock for all fallocate operations, not just for punch/collapse/insert modes. This prevents concurrent page faults from accessing unzeroed clusters during the allocation window.
This page as .md · .json · in your agent: get_signal("CVE-2026-99242")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.