CVE-2026-99102 in Linux
Summary
by MITRE • 10/28/2026
In the Linux kernel, the following vulnerability has been resolved:
ntfs: take invalidate_lock in ntfs_setattr_size()
ntfs_setattr_size() updates i_size and resizes the on-disk attribute without holding mapping->invalidate_lock. Page faults take the lock shared, so a fault racing the resize can resolve a VCN against the transient runlist state of ntfs_non_resident_attr_expand() and fail with a spurious SIGBUS, and can interleave with the size-change epilogue (truncate_pagecache(), i_size_write(), pagecache_isize_extended()).
Take invalidate_lock exclusively around the whole resize after inode_dio_wait(), matching the fallocate path and other filesystems such as xfs, which wraps truncate in its mmaplock (= invalidate_lock).
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/28/2026
The Linux kernel's NTFS file system implementation contained a concurrency vulnerability within the ntfs_setattr_size function that could lead to application crashes due to race conditions during file size modifications. This flaw stems from an incorrect locking strategy where the inode mapping invalidation lock, known as invalidate_lock, was not held exclusively while updating the i_size field and resizing the on-disk attribute data structures. In Linux VFS architecture, the invalidate_lock is critical for serializing operations that change a file's size against memory mappings, ensuring that page faults do not access inconsistent or transient state during structural changes to the underlying storage layout.
The technical root cause lies in the lack of exclusive lock acquisition around the resize operation within ntfs_setattr_size. When this function executes, it modifies the inode size and expands non-resident attributes without holding the necessary synchronization primitives. Concurrently, page faults triggered by memory-mapped I/O operations acquire the invalidate_lock in shared mode to resolve virtual cluster numbers against the current runlist state of the file system object. Because ntfs_setattr_size does not hold an exclusive lock during its critical section, a race condition emerges where a page fault can interleave with the resize operation or the subsequent size-change epilogue, which includes calls to truncate_pagecache and i_size_write.
This race condition results in a specific operational impact characterized by spurious SIGBUS signals being delivered to user-space applications. When a page fault occurs during this window of inconsistency, it may resolve a virtual cluster number against the transient runlist state generated by ntfs_non_resident_attr_expand rather than the stable final state. This mismatch causes the kernel to fail with an out-of-bounds access error, manifesting as a bus signal that terminates the offending process unexpectedly. Such behavior degrades system reliability and can lead to data loss or application instability for users relying on memory-mapped files within NTFS partitions.
The resolution involves modifying ntfs_setattr_size to take the invalidate_lock exclusively around the entire resize operation, specifically after calling inode_dio_wait to ensure no direct I/O operations are in flight. This approach aligns with established best practices observed in other robust file systems like XFS, which wraps similar truncate and size-change sequences within its mmaplock equivalent, effectively serializing these critical sections against concurrent memory mappings. By enforcing exclusive access during the structural update phase, the kernel prevents page faults from observing intermediate or inconsistent states of the runlist, thereby eliminating the race condition that leads to spurious bus errors.
From a vulnerability classification perspective, this issue maps directly to CWE-362, which describes Concurrent Execution using Shared Resource with Improper Synchronization, commonly known as a race condition. The specific mechanism involves shared resources such as memory mappings and inode metadata being accessed without proper locking protocols. In terms of the MITRE ATT&CK framework for enterprise security, this vulnerability relates to techniques involving resource manipulation that could be exploited by malicious actors to cause denial-of-service conditions or potentially escalate privileges if combined with other flaws, although its primary impact here is stability-related rather than direct privilege escalation.
Mitigation strategies primarily involve applying the kernel patch provided in the upstream Linux release notes for NTFS subsystem updates. System administrators should ensure their systems are updated to versions of the Linux kernel that include this specific fix for ntfs_setattr_size. For environments where immediate patching is not feasible, monitoring applications using memory-mapped files on NTFS volumes for unexpected terminations can serve as an indicator of compromise or system instability related to this flaw. Long-term resilience requires maintaining up-to-date kernels and adhering to strict locking protocols in any custom file system drivers or kernel modules that interact with inode size modifications.