CVE-2026-98138
Received Received - Intake

NTFS Dirty Bit Clearing Issue with Volume Errors

Publication date: 2026-09-25

Last updated on: 2026-09-25

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: ntfs: do not mark the volume clean in sync_fs when errors were recorded ntfs_put_super() and the remount-read-only path both clear the dirty bit only when NVolErrors(vol) is false. ntfs_sync_fs() clears it unconditionally, so any sync() on a volume that recorded an error marks that volume clean. A volume without this set is then seen as not needing recovery and it does not run one, so whatever went wrong is never repaired. This change skips resetting the dirty bit when there are volume errors. Reproduced on a volume whose $MFTMirr does not match $MFT, which sets the error flag while leaving the mount read-write: after a write and a sync, the on-disk volume flags read 0x0000 with this driver and 0x0001 with the guard in place.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-25
Last Modified
2026-09-25
Generated
2026-09-25
AI Q&A
2026-09-25
EPSS Evaluated
N/A
NVD
CVE-2026-98138
EUVD
EUVD-2026-86969

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel's NTFS driver allows a volume to be incorrectly marked as clean after errors occur. Normally, volumes with errors should remain dirty to trigger recovery processes. However, the sync_fs operation unconditionally clears the dirty bit, even when errors exist. This means errors may never be repaired because the system assumes no recovery is needed.

Detection Guidance

This vulnerability affects the Linux kernel's NTFS driver and may leave volumes marked as clean despite errors. Detection requires checking kernel logs for NTFS-related errors or examining NTFS volumes for mismatches between $MFT and $MFTMirr. Use commands like dmesg | grep ntfs or mount | grep ntfs to identify mounted NTFS volumes. Check for errors in /var/log/kern.log or /var/log/messages.

Impact Analysis

If you use NTFS volumes with the affected Linux kernel, this flaw could cause data corruption to go unnoticed. Errors like mismatched $MFTMirr and $MFT may not trigger recovery, leading to potential file system inconsistencies. Critical data might become inaccessible or corrupted without proper repair.

Mitigation Strategies

Apply the latest Linux kernel updates to patch this vulnerability. Avoid using the NTFS driver for critical operations until patched. If NTFS volumes are used, ensure regular fsck checks and backups. Monitor system logs for NTFS errors and consider switching to alternative filesystems if possible.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-98138. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart