CVE-2026-98141 in Linux
Summary
by MITRE • 09/25/2026
In the Linux kernel, the following vulnerability has been resolved:
ntfs: propagate reparse index insertion failure
update_reparse_data() ignores the return value of set_reparse_index(). When index insertion fails, the code removes the just-written reparse data as cleanup but still returns 0, so symlink(2) (and WSL special file creation) reports success while no reparse data exists on disk. When there was no previous reparse data (oldsize == 0), the failure was likewise silently ignored.
Propagate the error to the caller.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/25/2026
The vulnerability resides within the NTFS filesystem implementation in the Linux kernel, specifically affecting the update_reparse_data function which is responsible for managing reparse points such as symbolic links and junctions. Reparse data serves a critical role in Windows-compatible file systems by allowing files to contain metadata that directs how they are processed by the operating system rather than being treated as standard content. The core technical flaw lies in the improper handling of return values from internal helper functions, specifically set_reparse_index. When this function fails to insert the reparse index into the filesystem structures due to resource constraints or structural errors, update_reparse_data proceeds with cleanup operations that remove the partially written data but incorrectly returns a success code zero instead of propagating the error condition back to the caller.
This logic error creates a significant discrepancy between the state reported by system calls and the actual persistent state on disk. When an application invokes symlink or attempts to create special files through Windows Subsystem for Linux, it receives a confirmation that the operation succeeded despite the reparse data never being successfully persisted. This silent failure means that subsequent operations relying on these symbolic links will fail because the target path information is missing from the filesystem metadata. The issue persists regardless of whether there was existing reparse data or if this is a new creation, as both scenarios result in the error condition being masked by an incorrect success return value.
From a security and operational perspective, this vulnerability undermines the integrity of file system operations that depend on accurate symbolic link resolution. Applications expecting valid symlinks may encounter unexpected runtime errors when attempting to access targets that were never properly registered. In environments where WSL is used for development or deployment tasks involving complex directory structures, this can lead to data loss if scripts assume successful creation and proceed with further actions based on false premises. The lack of proper error propagation also complicates debugging efforts since the root cause remains hidden behind a misleading success status code.
The remediation involves modifying update_reparse_data to check the return value of set_reparse_index and propagate any non-zero error codes back to the calling function rather than returning zero. This ensures that callers like symlink receive accurate feedback about the outcome of their requests, allowing them to handle failures appropriately through standard exception handling or exit routines. Aligning this behavior with established security principles such as CWE-252 which addresses unchecked return values helps prevent similar issues in other kernel subsystems where error conditions must be strictly enforced to maintain system stability and data integrity.
In terms of threat modeling, this flaw aligns with ATT&CK techniques related to persistence mechanisms that rely on file system artifacts like symbolic links. While not directly exploitable for remote code execution, the ability to create broken symlinks could potentially be leveraged in social engineering attacks or as part of a broader strategy to disrupt service availability by corrupting expected directory structures. Mitigation strategies should prioritize applying kernel updates that include this fix and implementing rigorous testing procedures around file system operations involving reparse points to detect any anomalies early. Regular audits of error handling paths across the NTFS driver codebase are recommended to ensure consistent adherence to proper failure reporting standards throughout all related functions.