{"id":"CVE-2026-99242","kind":"vulnerability","aliases":["CVE-2026-99242"],"related":[],"title":"Linux kernel NTFS: fallocate race can expose stale disk data via mmap","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nntfs: fix race between fallocate and mmap reads\n\nThe fallocate implementation only takes invalidate_lock for punch hole,\ncollapse range, and insert range operations. For standard allocation modes\n(mode == 0, FALLOC_FL_KEEP_SIZE), the lock is not held.\n\nDuring ntfs_attr_fallocate(), new clusters are mapped to the runlist via\nntfs_attr_map_cluster() before being zeroed by ntfs_dio_zero_range(). This\ncreates a window where concurrent mmap page faults can read uninitialized\ndisk data.\n\nSince mmap uses filemap_fault() which takes invalidate_lock in shared mode,\nit can fault in pages during this window and expose old disk contents to\nuserspace. This is an information leak and data integrity issue.\n\nFix by taking invalidate_lock for all fallocate operations, not just for\npunch/collapse/insert modes. This prevents concurrent page faults from\naccessing unzeroed clusters during the allocation window.","summary":"In the Linux kernel's NTFS driver, fallocate allocates clusters before zeroing them, and a concurrent mmap page fault in that window can read old disk contents. An attacker who can use a mounted NTFS volume with mmap access could read leftover data from previously freed disk blocks.","severity":"low","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["linux-kernel","ntfs","runtime","self-hosted"],"not_affected_if":["no-ntfs-mounts","trusted-users-only"],"how_to_check":"- Check whether the kernel has NTFS support loaded or in use: `lsmod | grep ntfs`\n- Check the running kernel version: `uname -r` and compare against the fixed release in the kernel stable branch","fix":null,"status":"open","published_at":"2026-11-02T16:17:50+00:00","first_seen_at":"2026-11-02T16:24:06+00:00","triaged_at":"2026-11-02T16:26:49+00:00","updated_at":"2026-11-02T16:26:49+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-11-02T16:26:49Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Linux kernel NTFS: fallocate race can expose stale disk data via mmap","impact":"low","summary":"In the Linux kernel's NTFS driver, fallocate allocates clusters before zeroing them, and a concurrent mmap page fault in that window can read old disk contents. An attacker who can use a mounted NTFS volume with mmap access could read leftover data from previously freed disk blocks.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["linux-kernel","ntfs","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"local process reads uninitialized disk data from NTFS files","analyst_note":"Find the affected kernel version ranges and the stable commit that carries this fix, from the NVD entry or the kernel stable mailing list.","how_to_check":"- Check whether the kernel has NTFS support loaded or in use: `lsmod | grep ntfs`\n- Check the running kernel version: `uname -r` and compare against the fixed release in the kernel stable branch\n- unknown for affected version ranges, as the sources do not list them","plain_action":"","needs_analyst":true,"not_affected_if":["no-ntfs-mounts","trusted-users-only"],"who_is_affected":"Only systems that mount NTFS volumes through the Linux kernel's ntfs driver and let untrusted users or processes use mmap on those files are plausibly exposed. Systems that do not mount NTFS, or that use only trusted local users, can likely skip it. The sources do not give affected version ranges.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"low"},"cost_usd":0.000737,"input_tokens":4379,"output_tokens":598,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-99242':15A,18A '0':114C 'access':65B,218C 'alloc':35B,111C,223C 'attack':55B 'attr':126C,137C 'block':74B 'cluster':36B,129C,139C,220C 'collaps':103C 'concurr':42B,153C,214C 'content':53B,186C 'could':66B 'creat':149C 'cve':13A,16A 'data':10A,69B,161C,195C 'dio':145C 'disk':9A,52B,73B,160C,185C 'driver':33B 'expos':7A,183C 'falloc':4A,34B,89C,94C,115C,127C,205C 'fault':45B,156C,166C,176C,216C 'filemap':165C 'fix':86C,198C 'fl':116C 'follow':80C 'freed':72B 'held':123C 'hole':102C 'host':26B 'implement':95C 'inform':192C 'insert':106C 'integr':196C 'invalid':98C,169C,201C 'issu':197C 'keep':117C 'kernel':2A,21B,30B,78C 'leak':193C 'leftov':68B 'linux':1A,20B,29B,77C 'linux-kernel':19B 'lock':99C,120C,170C,202C 'map':131C,138C 'mmap':12A,43B,64B,91C,154C,163C 'mode':112C,113C,173C,211C 'mount':60B 'new':128C 'ntfs':3A,22B,32B,61B,85C,125C,136C,144C 'old':51B,184C 'oper':108C,206C 'page':44B,155C,178C,215C 'prevent':213C 'previous':71B 'punch':101C 'punch/collapse/insert':210C 'race':5A,87C 'rang':104C,107C,147C 'read':50B,67B,92C,158C 'resolv':84C 'runlist':134C 'runtim':23B 'self':25B 'self-host':24B 'share':172C 'sinc':162C 'size':118C 'stale':8A 'standard':110C 'take':97C,168C,200C 'uniniti':159C 'unzero':219C 'use':58B,164C 'userspac':188C 'via':11A,135C 'volum':62B 'vulner':81C 'window':48B,151C,181C,224C 'zero':38B,142C,146C","nicknames":[],"mitigations":[],"who_affected":"Only systems that mount NTFS volumes through the Linux kernel's ntfs driver and let untrusted users or processes use mmap on those files are plausibly exposed. Systems that do not mount NTFS, or that use only trusted local users, can likely skip it. The sources do not give affected version ranges.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["linuxkernel","low","ntfs","runtime","selfhosted"],"first_public_at":"2026-11-02T16:17:50+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-99242","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-99242","severity":null,"published_at":"2026-11-02T16:17:50+00:00","modified_at":"2026-11-02T16:17:50+00:00","first_seen_at":"2026-11-02T16:24:06+00:00","fetched_at":"2026-11-02T16:24:06+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}