All vulnerabilities
CVE-2026-98135

Linux: ntfs: reject invalid sectors_per_cluster in the boot sector

Linux LinuxOperating systems
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.10%Chance of exploitation activity in the next 30 days, higher than 0% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in7524c3145a3bac92bebbc47a29c007f1d874c9b3Also 323751a604e7533fa473874d999371592a614207CVE List
Published25 Sep 2026Updated 19 Oct 2026CVE List

What fixes it

  • 7524c3145a3bac92bebbc47a29c007f1d874c9b3LinuxCVE List
  • 323751a604e7533fa473874d999371592a614207LinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

ntfs: reject invalid sectors_per_cluster in the boot sector

is_boot_sector_ntfs() checks the boot sector's sectors_per_cluster field with a range test that rejects 0x81..0xf3 but accepts 0 and other non-power-of-two counts. A zero value reaches parse_ntfs_boot_sector():

sectors_per_cluster_bits = ffs(sectors_per_cluster) - 1; ... vol->cluster_size = vol->sector_size << sectors_per_cluster_bits;

ffs(0) is 0, so sectors_per_cluster_bits becomes (unsigned)-1 and the shift is undefined:

UBSAN: shift-out-of-bounds in fs/ntfs/super.c:673:39 shift exponent 4294967295 is too large for 32-bit type 'int'

This change rejects any non-power-of-two value, since it feeds the aforementioned shift via ffs() - 1, which only yields the correct shift for a power of two.

Text from CVE List

Affected versions 6

  • Linuxaffected: 6251f0b0de7d645e3591931ca4c11d8322c1866f before 7524c3145a3bac92bebbc47a29c007f1d874c9b3CVE List
  • Linuxaffected: 6251f0b0de7d645e3591931ca4c11d8322c1866f before 323751a604e7533fa473874d999371592a614207CVE List
  • Linuxaffected: 7.1CVE List
  • Linuxunaffected: all versions before 7.1CVE List
  • Linuxunaffected: 7.2.7 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 2