CVE-2026-99101 in Linux
Summary
by MITRE • 10/28/2026
In the Linux kernel, the following vulnerability has been resolved:
ntfs: move attribute payload before shrinking its record
ntfs_new_attr_flags() resizes the non-resident attribute record before moving its name and mapping pairs to their shorter-header offsets when compression or sparse state is cleared.
Shrinking the record first moves the following attribute over the tail of the old record. The subsequent memmove() therefore copies bytes from that following attribute instead of the old mapping pairs. Re-enabling compression on an empty file persists those bytes as a malformed mapping pairs array, which ntfsck reports as a missing or invalid run length.
Move the payload before shrinking the record, while retaining the existing resize-before-move ordering when growing it.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/28/2026
The vulnerability identified in the Linux kernel's NTFS filesystem driver involves a critical memory management error during attribute resizing operations, specifically within the ntfs_new_attr_flags function. This flaw occurs when the system attempts to clear compression or sparse state flags from an existing file. The core technical issue stems from an incorrect sequence of operations where the non-resident attribute record is shrunk before its payload data and mapping pairs are relocated to their new, shorter-header offsets. In NTFS structures, attributes are stored sequentially within a master file table record. When shrinking a record that contains multiple attributes or complex internal structures like mapping pairs for compressed files, the order of memory manipulation determines whether existing data remains intact or is corrupted.
By prioritizing the shrink operation over the move operation, the kernel inadvertently causes overlapping memory regions to interact incorrectly. Specifically, reducing the size of the attribute record first shifts the boundary such that subsequent attributes located after the target attribute overwrite the tail end of the old record space. When the system subsequently executes a memmove instruction to relocate the name and mapping pairs, it does not copy the intended original data from the pre-shrink state. Instead, because the memory layout has already been altered by the shrink operation, the memcpy process pulls bytes from the following attribute rather than the valid mapping pair information. This results in the corruption of the internal metadata that describes how file clusters are mapped to disk blocks.
The operational impact of this vulnerability is significant for data integrity and system stability. When compression or sparse state is re-enabled on a previously empty or modified file, the corrupted memory contents persist as part of the new attribute structure. This leads to the creation of malformed mapping pairs arrays that do not accurately reflect the physical location of data on disk. Filesystem check utilities like ntfsck will detect these inconsistencies and report them as missing or invalid run lengths. For end-users, this can manifest as file corruption where files become unreadable, contain garbage data, or cause application crashes when accessed. In severe cases involving critical system files stored on NTFS volumes, such metadata corruption could potentially lead to broader filesystem instability or denial of service conditions during mount operations or heavy I/O workloads.
This flaw is categorized under CWE-362, which covers concurrent execution issues and race-like behaviors in memory management, although it is more accurately described as a logic error leading to data corruption rather than a traditional time-of-check-to-time-of-use race condition. From an attack perspective, while this vulnerability primarily affects local integrity rather than providing immediate remote code execution vectors, it aligns with ATT&CK techniques related to Data Destruction or Impair Defenses if exploited by malicious actors who can trigger specific file attribute modifications on accessible NTFS volumes. The ability to corrupt filesystem metadata could be leveraged in scenarios where an attacker seeks to disrupt service availability or hide evidence of data tampering by rendering forensic analysis tools unable to parse the affected files correctly.
Mitigation strategies for this vulnerability involve applying kernel patches that correct the ordering logic within ntfs_new_attr_flags. Developers must ensure that payload relocation and mapping pair adjustments are completed before any reduction in record size occurs, thereby preserving the integrity of adjacent memory regions during resize operations. For system administrators managing Linux environments with NTFS support, it is crucial to keep kernels updated to versions where this patch has been integrated. Additionally, regular filesystem checks using ntfsck on mounted or unmounted volumes can help identify and repair any existing corruption resulting from prior exposure to the flaw. Preventive measures also include avoiding unnecessary toggling of compression flags on empty files until the underlying kernel logic is verified as secure in production environments.