CVE-2026-98137
Linux: ntfs: treat any nonzero dio zero-range return as an error
Linux LinuxOperating systemsCVSS
NoneNot scoredExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.10%Chance of exploitation activity in the next 30 days, higher than 0% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in56392b0d5290ff2b05fc673bc07803b8ae4cfd1bAlso 607a9478833db656e7ceac8e9e382fa4acfde545CVE List
What fixes it
- 56392b0d5290ff2b05fc673bc07803b8ae4cfd1bLinuxCVE List
- 607a9478833db656e7ceac8e9e382fa4acfde545LinuxCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
In the Linux kernel, the following vulnerability has been resolved:
ntfs: treat any nonzero dio zero-range return as an error
ntfs_dio_zero_range() returns either 0 or a negative errno from blkdev_issue_zeroout(); it never returns a positive value. The zeroing failure check in ntfs_attr_fallocate() therefore never fired, so a failed zeroing operation was silently ignored: the loop kept going, the newly allocated clusters were folded into initialized_size and the write could succeed leaving stale on-disk data.
Treat any nonzero return as an error and abort the allocation.
Text from CVE List
Affected versions 6
- Linuxaffected: 495e90fa334828d4119061e2726af51d0a0fb4ed before 56392b0d5290ff2b05fc673bc07803b8ae4cfd1bCVE List
- Linuxaffected: 495e90fa334828d4119061e2726af51d0a0fb4ed before 607a9478833db656e7ceac8e9e382fa4acfde545CVE List
- Linuxaffected: 7.1CVE List
- Linuxunaffected: all versions before 7.1CVE List
- Linuxunaffected: 7.2.7 through 7.2.*CVE List
- Linuxunaffected: 7.3CVE List