CVE-2026-98315

Received Received - Intake

BaseFortify

Publication date: 2026-10-06

Last updated on: 2026-10-19

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: ntfs: protect runlist updates with the runlist lock ntfs_non_resident_attr_shrink() calls runlist helpers that require the runlist write lock, but did not hold it while freeing clusters and truncating the runlist. Serialize those operations and the resident conversion with the runlist lock. ntfs_attr_map_cluster() can merge a newly allocated run before updating mapping pairs. If the update fails, free the clusters and restore both the in-memory runlist and on-disk mapping pairs from a saved runlist. Mark the volume in error if either rollback step fails.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-06

Last Modified

2026-10-19

Generated

2026-10-19

AI Q&A

2026-10-06

EPSS Evaluated

2026-10-18

NVD

CVE-2026-98315

EUVD

EUVD-2026-93300

Affected Vendors & Products

Vendor	Product	Version / Range
Linux	Linux	495e90fa334828d4119061e2726af51d0a0fb4ed
Linux	Linux	495e90fa334828d4119061e2726af51d0a0fb4ed
Linux	Linux	7.1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves improper handling of NTFS runlist updates. The ntfs_non_resident_attr_shrink() function frees clusters and truncates the runlist without holding the required runlist write lock. Additionally, ntfs_attr_map_cluster() may merge a newly allocated run before updating mapping pairs, risking data corruption if the update fails.

Detection Guidance

This vulnerability affects the Linux kernel's NTFS file system handling. Detection requires checking kernel versions and NTFS-related logs or errors. Use commands like 'uname -a' to check kernel version and 'dmesg | grep ntfs' to look for NTFS-related errors. If you suspect exploitation, monitor for unusual file system activity or corruption in NTFS partitions.

Impact Analysis

This vulnerability could lead to data corruption or system crashes on Linux systems using NTFS filesystems. Attackers might exploit it to cause denial-of-service conditions or unauthorized data access if they gain local execution privileges.

Compliance Impact

This vulnerability affects data integrity and availability in the Linux kernel's NTFS filesystem. While it does not directly impact compliance with GDPR or HIPAA, it could lead to data corruption or loss, which may violate data protection requirements under these regulations if exploited.

Mitigation Strategies

Update your Linux kernel to the latest stable version that includes the fix for this NTFS vulnerability. If immediate patching is not possible, consider disabling NTFS support or restricting access to NTFS partitions until patched. Monitor vendor advisories for kernel updates addressing this issue.

Hi! I’m here to help you understand CVE-2026-98315. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70