542783 matches found
CVE-2026-98140
The Linux kernel contains a vulnerability in the ntfs module where the write_mft_record_nolock() function fails to unmap a folio on specific error paths (pre_write_mst_fixup() and bio_add_folio()). This results in a kmap_local leak . Because these mappings are stack-ordered per task, leaking a ma...
EUVD-2026-86971
In the Linux kernel, the following vulnerability has been resolved: ntfs: fix kmaplocal leak in writemftrecordnolock error paths writemftrecordnolock maps the MFT record folio with kmaplocalfolio, but the prewritemstfixup and bioaddfolio failure paths jump to the error label without unmapping it...
CVE-2026-98139
The Linux kernel contains a vulnerability in the ntfs component where the function ntfs_cluster_free_from_rl_nolock() incorrectly increments nr_freed even when ntfs_bitmap_clear_run() fails. Because a failed operation rolls back partial modifications, the length of the failed run still inflates v...
EUVD-2026-86970
In the Linux kernel, the following vulnerability has been resolved: ntfs: only count successfully cleared runs when freeing clusters ntfsclusterfreefromrlnolock adds a run's length to nrfreed whenever the error bookkeeping condition is false, which includes cases where ntfsbitmapclearrun actually...
CVE-2026-98138 ntfs: do not mark the volume clean in sync_fs when errors were recorded
In the Linux kernel, the following vulnerability has been resolved: ntfs: do not mark the volume clean in syncfs when errors were recorded ntfsputsuper and the remount-read-only path both clear the dirty bit only when NVolErrorsvol is false. ntfssyncfs clears it unconditionally, so any sync on a...
CVE-2026-98139 ntfs: only count successfully cleared runs when freeing clusters
In the Linux kernel, the following vulnerability has been resolved: ntfs: only count successfully cleared runs when freeing clusters ntfsclusterfreefromrlnolock adds a run's length to nrfreed whenever the error bookkeeping condition is false, which includes cases where ntfsbitmapclearrun actually...
CVE-2026-98138
The Linux kernel ntfs driver contains a vulnerability where ntfs_sync_fs() unconditionally clears the dirty bit of a volume. If a volume recorded an error (e.g., $MFTMirr does not match $MFT), performing a sync() would incorrectly mark it as clean. This prevents the system from initiating necessa...
CVE-2026-98139 ntfs: only count successfully cleared runs when freeing clusters
In the Linux kernel, the following vulnerability has been resolved: ntfs: only count successfully cleared runs when freeing clusters ntfsclusterfreefromrlnolock adds a run's length to nrfreed whenever the error bookkeeping condition is false, which includes cases where ntfsbitmapclearrun actually...
EUVD-2026-86969
In the Linux kernel, the following vulnerability has been resolved: ntfs: do not mark the volume clean in syncfs when errors were recorded ntfsputsuper and the remount-read-only path both clear the dirty bit only when NVolErrorsvol is false. ntfssyncfs clears it unconditionally, so any sync on a...
CVE-2026-98137 ntfs: treat any nonzero dio zero-range return as an error
In the Linux kernel, the following vulnerability has been resolved: ntfs: treat any nonzero dio zero-range return as an error ntfsdiozerorange returns either 0 or a negative errno from blkdevissuezeroout; it never returns a positive value. The zeroing failure check in ntfsattrfallocate therefore...
CVE-2026-98137
The Linux kernel contains a vulnerability in the ntfs file system where a failed zeroing operation could be silently ignored. Specifically, the ntfs_dio_zero_range() function returns a negative errno or zero from blkdev_issue_zeroout() , but the zeroing failure check in ntfs_attr_fallocate() fail...
CVE-2026-98136 ntfs: bound $AttrDef table walk to the loaded table size
In the Linux kernel, the following vulnerability has been resolved: ntfs: bound $AttrDef table walk to the loaded table size ntfsattrfindinattrdef walks the in-memory $AttrDef table, but the loop condition bounds only the start of each entry, not the whole entry: for ad = vol-attrdef; u8 ad - u8...
EUVD-2026-86967
In the Linux kernel, the following vulnerability has been resolved: ntfs: bound $AttrDef table walk to the loaded table size ntfsattrfindinattrdef walks the in-memory $AttrDef table, but the loop condition bounds only the start of each entry, not the whole entry: for ad = vol-attrdef; u8 ad - u8...
EUVD-2026-86968
In the Linux kernel, the following vulnerability has been resolved: ntfs: treat any nonzero dio zero-range return as an error ntfsdiozerorange returns either 0 or a negative errno from blkdevissuezeroout; it never returns a positive value. The zeroing failure check in ntfsattrfallocate therefore...
CVE-2026-98136
The Linux kernel contains a vulnerability in the ntfs file system where the ntfs_attr_find_in_attrdef() function fails to properly bound the walk of the in-memory $AttrDef table. The loop condition only checks the start of each entry rather than the entire 160-byte struct attr_def, allowing a rea...
CVE-2026-98137 ntfs: treat any nonzero dio zero-range return as an error
In the Linux kernel, the following vulnerability has been resolved: ntfs: treat any nonzero dio zero-range return as an error ntfsdiozerorange returns either 0 or a negative errno from blkdevissuezeroout; it never returns a positive value. The zeroing failure check in ntfsattrfallocate therefore...
CVE-2026-98135
The Linux kernel contains a vulnerability in the ntfs filesystem driver where the is_boot_sector_ntfs() function incorrectly accepts a value of 0 or other non-power-of-two counts for the sectors_per_cluster field in the boot sector. When a zero value is processed by parse_ntfs_boot_sector(), the ...
CVE-2026-98135 ntfs: reject invalid sectors_per_cluster in the boot sector
In the Linux kernel, the following vulnerability has been resolved: ntfs: reject invalid sectorspercluster in the boot sector isbootsectorntfs checks the boot sector's sectorspercluster field with a range test that rejects 0x81..0xf3 but accepts 0 and other non-power-of-two counts. A zero value...
EUVD-2026-86966
In the Linux kernel, the following vulnerability has been resolved: ntfs: reject invalid sectorspercluster in the boot sector isbootsectorntfs checks the boot sector's sectorspercluster field with a range test that rejects 0x81..0xf3 but accepts 0 and other non-power-of-two counts. A zero value...
EUVD-2026-86964
In the Linux kernel, the following vulnerability has been resolved: ntfs: leave HasEA flag untouched on setxattr failure In ntfssetea, the exit path unconditionally updates the HasEA flag based on eainfoqsize. When an error occurs before eainfoqsize is updated, NInoClearHasEA hides existing on-di...