CVE-2026-98140

Analyzed Analyzed - Analysis Complete

Memory Leak in Linux Kernel NTFS Driver

Publication date: 2026-09-25

Last updated on: 2026-10-26

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: ntfs: fix kmap_local leak in write_mft_record_nolock() error paths write_mft_record_nolock() maps the MFT record folio with kmap_local_folio(), but the pre_write_mst_fixup() and bio_add_folio() failure paths jump to the error label without unmapping it. kmap_local mappings are stack-ordered per task, so leaking one corrupts the nesting for any outer mapping. Unmap the folio on those error paths too.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-25

Last Modified

2026-10-26

Generated

2026-11-08

AI Q&A

2026-09-25

EPSS Evaluated

2026-11-07

NVD

CVE-2026-98140

EUVD

EUVD-2026-86971

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	7.3
linux	linux_kernel	From 7.1 (inc) to 7.2.7 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-401	The product does not sufficiently track and release allocated memory after it has been used, making the memory unavailable for reallocation and reuse.

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a memory mapping issue in the NTFS file system. The function write_mft_record_nolock() uses kmap_local_folio() to map an MFT record folio but fails to unmap it in certain error paths. This leads to a kmap_local leak, which corrupts the stack-ordered mappings for the task.

Detection Guidance

This vulnerability is specific to the Linux kernel's NTFS implementation and involves a kmap_local leak in the write_mft_record_nolock() function. Detection requires checking kernel logs for errors related to NTFS operations or kmap_local usage. Commands like dmesg | grep -i ntfs or journalctl -k | grep -i ntfs may help identify issues. Ensure your kernel version is up to date to confirm if the fix is applied.

Impact Analysis

This vulnerability could cause system instability or crashes due to corrupted memory mappings. It may also lead to data corruption or unexpected behavior in applications using the NTFS file system, potentially affecting system performance and reliability.

Compliance Impact

This vulnerability does not directly affect compliance with standards like GDPR or HIPAA as it is a low-level kernel memory management issue. It may indirectly impact compliance if the affected system is used to process sensitive data, but no specific compliance implications are mentioned in the provided context.

Mitigation Strategies

Update your Linux kernel to the latest stable version that includes the fix for this vulnerability. If immediate patching is not possible, avoid using NTFS file systems until the update is applied. Monitor kernel logs for any signs of kmap_local leaks or NTFS-related errors.

Hi! I’m here to help you understand CVE-2026-98140. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...