All vulnerabilities
CVE-2026-98139

Linux: ntfs: only count successfully cleared runs when freeing clusters

Linux LinuxOperating systems
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.13%Chance of exploitation activity in the next 30 days, higher than 2% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in7eb97d8828e7758b9c81277f7802e740a800f78aFixed versionCVE List
Published25 Sep 2026Updated 19 Oct 2026CVE List

What fixes it

  • 7eb97d8828e7758b9c81277f7802e740a800f78aLinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

ntfs: only count successfully cleared runs when freeing clusters

ntfs_cluster_free_from_rl_nolock() adds a run's length to nr_freed whenever the error bookkeeping condition is false, which includes cases where ntfs_bitmap_clear_run() actually failed - e.g. a second run failing with the same errno as an earlier one, or any failure after a non-ENOMEM error was already recorded. Since a failed ntfs_bitmap_clear_run() rolls back its partial modifications, no bits were cleared for that run, yet its length still inflates vol->free_clusters, corrupting statfs output and the allocator's free space gate.

Only count runs whose bitmap clear succeeded.

Text from CVE List

Affected versions 6

  • Linuxaffected: 11ccc9107dc460de28af90fac1f42404d9802735 before 7eb97d8828e7758b9c81277f7802e740a800f78aCVE List
  • Linuxaffected: 11ccc9107dc460de28af90fac1f42404d9802735 before be9e89ccb8e52a3e4b67feeb03ebd8133091dc7eCVE List
  • Linuxaffected: 7.1CVE List
  • Linuxunaffected: all versions before 7.1CVE List
  • Linuxunaffected: 7.2.7 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 2