{"id":"CVE-2026-99260","kind":"vulnerability","aliases":["CVE-2026-99260"],"related":[],"title":"Linux kernel: NTFS resident attribute conversion flaw skips needed conversion","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nntfs: fix resident conversion in ntfs_new_attr_flags\n\nWhen setting sparse/compressed flags on a resident attribute, the\nfunction skipped the resident-to-non-resident conversion and\nterminated.","summary":"In the Linux kernel's NTFS driver, setting sparse or compressed flags on a resident attribute skipped the resident-to-non-resident conversion and terminated early. The sources do not state what an attacker gains from this.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","linux-kernel","ntfs"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-03T12:17:32+00:00","first_seen_at":"2026-11-03T12:20:39+00:00","triaged_at":"2026-11-03T12:22:46+00:00","updated_at":"2026-11-03T12:22:46+00:00","category":"infrastructure","confidence":0.35,"triage":{"at":"2026-11-03T12:22:46Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Linux kernel: NTFS resident attribute conversion flaw skips needed conversion","impact":"low","summary":"In the Linux kernel's NTFS driver, setting sparse or compressed flags on a resident attribute skipped the resident-to-non-resident conversion and terminated early. The sources do not state what an attacker gains from this.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["linux-kernel","ntfs"],"confidence":0.35,"fix_status":"unknown","needs_auth":"unknown","worst_case":"unknown; sources do not state the impact","analyst_note":"Find the kernel commit for ntfs_new_attr_flags and the affected and fixed kernel versions, and check whether a crafted NTFS image can trigger it.","how_to_check":"- unknown","plain_action":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Systems that mount NTFS volumes with the Linux kernel's ntfs driver are the ones to look at. The sources do not say which kernel versions are affected or what conditions trigger the flaw. unknown","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000633,"input_tokens":4110,"output_tokens":443,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-99260':13A,16A 'attack':56B 'attr':75C 'attribut':5A,37B,84C 'compress':32B 'convers':6A,10A,45B,71C,94C 'cve':11A,14A 'driver':28B 'earli':48B 'fix':69C 'flag':33B,76C,80C 'flaw':7A 'follow':63C 'function':86C 'gain':57B 'infrastructur':17B 'kernel':2A,20B,25B,61C 'linux':1A,19B,24B,60C 'linux-kernel':18B 'need':9A 'new':74C 'non':43B,92C 'ntfs':3A,21B,27B,68C,73C 'resid':4A,36B,41B,44B,70C,83C,90C,93C 'resident-to-non-resid':40B,89C 'resolv':67C 'set':29B,78C 'skip':8A,38B,87C 'sourc':50B 'spars':30B 'sparse/compressed':79C 'state':53B 'termin':47B,96C 'vulner':64C","nicknames":[],"mitigations":[],"who_affected":"Systems that mount NTFS volumes with the Linux kernel's ntfs driver are the ones to look at. The sources do not say which kernel versions are affected or what conditions trigger the flaw. unknown","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["infrastructure","linuxkernel","ntfs","unknown"],"first_public_at":"2026-11-03T12:17:32+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-99260","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-99260","severity":null,"published_at":"2026-11-03T12:17:32+00:00","modified_at":"2026-11-03T12:17:32+00:00","first_seen_at":"2026-11-03T12:20:39+00:00","fetched_at":"2026-11-03T12:20:39+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}