CVE-2026-98137 in Linux
Summary
by MITRE • 09/25/2026
In the Linux kernel, the following vulnerability has been resolved:
ntfs: treat any nonzero dio zero-range return as an error
ntfs_dio_zero_range() returns either 0 or a negative errno from blkdev_issue_zeroout(); it never returns a positive value. The zeroing failure check in ntfs_attr_fallocate() therefore never fired, so a failed zeroing operation was silently ignored: the loop kept going, the newly allocated clusters were folded into initialized_size and the write could succeed leaving stale on-disk data.
Treat any nonzero return as an error and abort the allocation.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/25/2026
The vulnerability identified in the Linux kernel's NTFS filesystem driver represents a critical logic flaw within the direct I/O zero-range handling mechanism, specifically located in the ntfs_dio_zero_range function. This issue stems from an incorrect assumption regarding the return values of the underlying block device operation blkdev_issue_zeroout. The developer who authored or maintained this code segment incorrectly assumed that any non-zero return value would necessarily indicate a negative error code, which is standard for many Linux kernel functions returning errno values. However, in practice, while ntfs_dio_zero_range typically returns zero on success or a negative errno on failure, the check implemented within ntfs_attr_fallocate was insufficiently robust to handle potential edge cases or future changes where positive return codes might be introduced or misinterpreted. Consequently, if blkdev_issue_zeroout were to ever return a positive value for any reason, or if there were subtle variations in how errors are propagated through the stack, the conditional check would fail to trigger an error state. This oversight means that when zeroing out allocated clusters fails, the system does not abort the operation as intended but instead proceeds under the false assumption of success.
The operational impact of this flaw is severe because it leads to silent data corruption and potential security risks related to information disclosure. When a write operation triggers fallocate calls that require zeroing previously uninitialized or freed disk space, the kernel attempts to ensure that no stale data from previous users remains on those clusters before writing new content. This process is crucial for maintaining data integrity and preventing leakage of sensitive information stored in those sectors by prior processes. Due to the logic error described, if the zeroing operation fails silently, the newly allocated clusters are incorrectly marked as initialized and included in the file's size metrics. Subsequently, a write operation may succeed in placing new data into these clusters, but any portion not explicitly overwritten will retain its previous contents. This results in stale on-disk data persisting within what should be clean storage space, violating the fundamental expectation that allocated blocks are zeroed before use to prevent information leaks and ensure consistent file system behavior.
From a technical classification perspective, this vulnerability aligns with CWE-252, which describes unchecked return values, as the code failed to properly validate the outcome of a critical function call. Furthermore, it relates to CWE-697 regarding incorrect comparison logic, specifically in how the return value was evaluated against expected error states rather than any non-success state. In terms of attack vectors and behavioral analysis under MITRE ATT&CK frameworks, this flaw could potentially be leveraged for data leakage scenarios where an attacker might infer previous file contents or system state by analyzing residual data patterns that were not properly scrubbed. While direct exploitation requires specific conditions involving allocation failures during zeroing operations, the presence of such a bug undermines the reliability guarantees provided by the NTFS driver and compromises the confidentiality integrity triad within environments relying on strict disk space sanitization protocols.
Mitigation for this vulnerability involves applying the kernel patch that corrects the conditional logic to treat any nonzero return value from ntfs_dio_zero_range as an error condition, thereby forcing an abort of the allocation process if zeroing fails. System administrators should ensure their systems are updated with the latest stable Linux kernel versions containing this fix. For organizations running custom or older kernels where immediate patching is not feasible, implementing strict monitoring for NTFS volume errors and ensuring that underlying block devices report failures accurately can help mitigate some risks. Additionally, adopting defense-in-depth strategies such as full disk encryption reduces the impact of residual data exposure since stale data would be encrypted with keys unknown to potential attackers. Regular auditing of file system drivers and adherence to secure coding practices that mandate explicit handling of all possible return codes are essential preventive measures against similar logic flaws in future development cycles.