CVE-2026-99242
Received Received - Intake

Race Condition in Linux Kernel NTFS Fallocate Leading to Information Disclosure

Publication date: 2026-11-02

Last updated on: 2026-11-02

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: ntfs: fix race between fallocate and mmap reads The fallocate implementation only takes invalidate_lock for punch hole, collapse range, and insert range operations. For standard allocation modes (mode == 0, FALLOC_FL_KEEP_SIZE), the lock is not held. During ntfs_attr_fallocate(), new clusters are mapped to the runlist via ntfs_attr_map_cluster() before being zeroed by ntfs_dio_zero_range(). This creates a window where concurrent mmap page faults can read uninitialized disk data. Since mmap uses filemap_fault() which takes invalidate_lock in shared mode, it can fault in pages during this window and expose old disk contents to userspace. This is an information leak and data integrity issue. Fix by taking invalidate_lock for all fallocate operations, not just for punch/collapse/insert modes. This prevents concurrent page faults from accessing unzeroed clusters during the allocation window.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-02
Last Modified
2026-11-02
Generated
2026-11-02
AI Q&A
2026-11-02
EPSS Evaluated
N/A
NVD
CVE-2026-99242

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
Linux Linux 495e90fa334828d4119061e2726af51d0a0fb4ed
Linux Linux 495e90fa334828d4119061e2726af51d0a0fb4ed
Linux Linux 7.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a race condition between fallocate operations and mmap reads in the NTFS filesystem. When fallocate allocates new disk clusters, it maps them before zeroing, creating a window where concurrent mmap page faults can read uninitialized disk data. This exposes old disk contents to userspace, causing an information leak and data integrity issue.

Detection Guidance

This vulnerability is specific to the Linux kernel's NTFS implementation and does not have a direct network detection method. To check if your system is affected, verify the kernel version and NTFS code. Use commands like 'uname -a' to check the kernel version and inspect the NTFS code for the presence of the fix. If the kernel version is below the patched version or the code lacks the invalidate_lock fix, the system is vulnerable.

Impact Analysis

This vulnerability could allow attackers to read sensitive or previously deleted data from disk by exploiting the race condition during file allocation. It may also lead to data corruption if uninitialized data is written or read incorrectly. Systems using NTFS with concurrent fallocate and mmap operations are at risk.

Compliance Impact

This vulnerability could violate data protection regulations like GDPR and HIPAA by enabling unauthorized access to sensitive data. GDPR requires protecting personal data, and HIPAA mandates safeguarding protected health information. A successful exploit could lead to data breaches, resulting in legal penalties and reputational damage.

Mitigation Strategies

Apply the latest kernel update that includes the fix for this NTFS fallocate race condition. If an update is not immediately available, consider disabling NTFS support or restricting access to NTFS filesystems until the patch is applied. Monitor vendor advisories for kernel updates addressing CVE-2026-99242.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-99242. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...