CVE-2026-99101

In the Linux kernel, the following vulnerability has been resolved: ntfs: move attribute payload before shrinking its record ntfs_new_attr_flags() resizes the non-resident attribute record before moving its name and mapping pairs to their shorter-header offsets when compression or sparse state is cleared. Shrinking the record first moves the following attribute over the tail of the old record. The subsequent memmove() therefore copies bytes from that following attribute instead of the old mapping pairs. Re-enabling compression on an empty file persists those bytes as a malformed mapping pairs array, which ntfsck reports as a missing or invalid run length. Move the payload before shrinking the record, while retaining the existing resize-before-move ordering when growing it.

CVSS

No CVSS.

References

Link	Resource
https://git.kernel.org/stable/c/0ab6dc1ac4601c8d79e5448a024daed6b0c5ef64
https://git.kernel.org/stable/c/7dc2c524608039d1b082a0087f7aa0751edd4ffb

Configurations

No configuration.

History

28 Oct 2026, 11:17

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-10-28 11:17

Updated : 2026-11-01 13:18

NVD link : CVE-2026-99101

Mitre link : CVE-2026-99101

CVE.ORG link : CVE-2026-99101

JSON object : View

Products Affected

No product.

CWE

No CWE.

{"id": "CVE-2026-99101", "cveTags": [], "metrics": {}, "affected": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "affectedData": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "47503f989736d6c4c9f8bfca1c28d267473ccd4b", "lessThan": "7dc2c524608039d1b082a0087f7aa0751edd4ffb", "versionType": "git"}, {"status": "affected", "version": "47503f989736d6c4c9f8bfca1c28d267473ccd4b", "lessThan": "0ab6dc1ac4601c8d79e5448a024daed6b0c5ef64", "versionType": "git"}], "programFiles": ["fs/ntfs/ea.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "7.1"}, {"status": "unaffected", "version": "0", "lessThan": "7.1", "versionType": "semver"}, {"status": "unaffected", "version": "7.2.13", "versionType": "semver", "lessThanOrEqual": "7.2.*"}, {"status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["fs/ntfs/ea.c"], "defaultStatus": "affected"}]}], "published": "2026-10-28T11:17:29.367", "references": [{"url": "https://git.kernel.org/stable/c/0ab6dc1ac4601c8d79e5448a024daed6b0c5ef64", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/7dc2c524608039d1b082a0087f7aa0751edd4ffb", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "vulnStatus": "Received", "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nntfs: move attribute payload before shrinking its record\n\nntfs_new_attr_flags() resizes the non-resident attribute record before\nmoving its name and mapping pairs to their shorter-header offsets when\ncompression or sparse state is cleared.\n\nShrinking the record first moves the following attribute over the tail of\nthe old record. The subsequent memmove() therefore copies bytes from that\nfollowing attribute instead of the old mapping pairs. Re-enabling\ncompression on an empty file persists those bytes as a malformed mapping\npairs array, which ntfsck reports as a missing or invalid run length.\n\nMove the payload before shrinking the record, while retaining the existing\nresize-before-move ordering when growing it."}], "lastModified": "2026-11-01T13:18:02.030", "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}