CVE-2026-98139
Received Received - Intake

NTFS Cluster Free Corruption in Linux Kernel

Publication date: 2026-09-25

Last updated on: 2026-09-25

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: ntfs: only count successfully cleared runs when freeing clusters ntfs_cluster_free_from_rl_nolock() adds a run's length to nr_freed whenever the error bookkeeping condition is false, which includes cases where ntfs_bitmap_clear_run() actually failed - e.g. a second run failing with the same errno as an earlier one, or any failure after a non-ENOMEM error was already recorded. Since a failed ntfs_bitmap_clear_run() rolls back its partial modifications, no bits were cleared for that run, yet its length still inflates vol->free_clusters, corrupting statfs output and the allocator's free space gate. Only count runs whose bitmap clear succeeded.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-25
Last Modified
2026-09-25
Generated
2026-09-25
AI Q&A
2026-09-25
EPSS Evaluated
N/A
NVD
CVE-2026-98139
EUVD
EUVD-2026-86970

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel affects the NTFS file system. It occurs in the function ntfs_cluster_free_from_rl_nolock() which incorrectly counts runs of clusters even when the bitmap clearing operation fails. This leads to an overestimation of free clusters, corrupting the statfs output and the allocator's free space tracking.

Detection Guidance

This vulnerability affects the Linux kernel's NTFS filesystem handling. Detection requires checking kernel logs for NTFS-related errors or filesystem corruption. Use commands like dmesg | grep -i ntfs or journalctl -k | grep -i ntfs to search for errors. Verify filesystem integrity with fsck -N /dev/sdX for affected partitions.

Impact Analysis

This vulnerability can cause incorrect reporting of free disk space, potentially leading to system instability or crashes. Applications relying on accurate free space information may behave unpredictably, and the system might fail to allocate new files due to incorrect free space calculations.

Mitigation Strategies

Immediately update your Linux kernel to the latest patched version. Avoid using NTFS filesystems until patched. If NTFS is required, consider temporarily switching to another filesystem type. Monitor system logs for NTFS errors as a sign of exploitation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-98139. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart