All vulnerabilities
CVE-2026-99107

Linux: ntfs: fix incorrect MFT record pointer passed to ntfs_attr_record_resize

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
Fixed in0a9122cada749447dfb6d67aa3fed4ee1982231cAlso 8d139e3635c86e2c97c78d55538ce0b00b6d9986CVE List
Published28 Oct 2026Updated 28 Oct 2026CVE List

What fixes it

  • 0a9122cada749447dfb6d67aa3fed4ee1982231cLinuxCVE List
  • 8d139e3635c86e2c97c78d55538ce0b00b6d9986LinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

ntfs: fix incorrect MFT record pointer passed to ntfs_attr_record_resize

ntfs_new_attr_flags() passes the wrong MFT record to ntfs_attr_record_resize(). When the attribute is in an extent record, ctx->mrec points to the extent but the function receives the base record pointer m, causing incorrect size calculations in memmove.

Fix by passing ctx->mrec (the actual MFT record containing the attribute) instead of m (the base MFT record) to ntfs_attr_record_resize().

Text from CVE List

Affected versions 6

  • Linuxaffected: fc053f05ca282a5e760b41f6560ac835c4e28037 before 0a9122cada749447dfb6d67aa3fed4ee1982231cCVE List
  • Linuxaffected: fc053f05ca282a5e760b41f6560ac835c4e28037 before 8d139e3635c86e2c97c78d55538ce0b00b6d9986CVE List
  • Linuxaffected: 7.1CVE List
  • Linuxunaffected: all versions before 7.1CVE List
  • Linuxunaffected: 7.2.13 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 2