CVE-2026-99260 in Linux
Summary
by MITRE • 11/03/2026
In the Linux kernel, the following vulnerability has been resolved:
ntfs: fix resident conversion in ntfs_new_attr_flags
When setting sparse/compressed flags on a resident attribute, the function skipped the resident-to-non-resident conversion and terminated.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 11/03/2026
The vulnerability identified within the NTFS file system implementation of the Linux kernel centers on an incorrect handling of attribute flag modifications during the initialization phase. Specifically, in the ntfs_new_attr_flags function, there is a logic error that occurs when attempting to set sparse or compressed flags on attributes classified as resident. In the NTFS architecture, data can be stored either directly within the attribute record itself if it fits (resident) or via a series of extents pointing to disk clusters if it exceeds a certain size threshold (non-resident). The file system logic dictates that when specific metadata flags such as compression are applied, the storage method may need to change from resident to non-resident to accommodate the overhead required for managing compressed data streams. However, the flawed code path incorrectly determines that no conversion is necessary and terminates the operation prematurely without performing the critical structural transition from a resident attribute structure to a non-resident one.
This technical flaw represents a failure in state management within the file system driver, leading to potential inconsistencies between the metadata flags declared for an attribute and its actual physical storage format on disk. By skipping the resident-to-non-resident conversion, the kernel leaves the attribute in an invalid or inconsistent state where it claims support for features like compression but lacks the necessary infrastructure to manage them effectively. This discrepancy can result in data corruption when subsequent operations attempt to read or write compressed data using assumptions that rely on a properly initialized non-resident structure. The issue is particularly dangerous because it may not immediately manifest as a crash, allowing corrupted files to persist and potentially propagate errors during backup processes, defragmentation, or standard file access routines that expect consistent metadata behavior.
From an operational impact perspective, this vulnerability can lead to data integrity issues for users relying on NTFS volumes within Linux environments, particularly those utilizing advanced features like disk compression or sparse file allocation. While the immediate risk of remote code execution is low given the local nature of most file system interactions, the potential for silent data corruption poses a significant threat to business continuity and data reliability. Attackers with local access could potentially exploit this inconsistency to create malformed files that confuse other applications or security tools relying on accurate NTFS metadata parsing. Furthermore, in virtualized environments where disk images are frequently mounted and modified, such inconsistencies can lead to broader storage subsystem instability if the underlying block layer attempts to interpret corrupted attribute structures as valid data blocks.
The root cause of this issue aligns with CWE-841 Improper Enforcement of Behavioral Restrictions, as the code fails to enforce the necessary behavioral change in data structure layout when specific constraints or flags are applied. It also relates to CWE-697 Incorrect Comparison during Software Activation, where the logic for determining whether a conversion is needed relies on flawed conditional checks that do not account for all flag combinations requiring structural changes. In terms of MITRE ATT&CK mapping, this type of vulnerability falls under T1485 Data Destruction or T1036 Masquerading if exploited to hide malicious data by creating files with misleading metadata properties, although its primary classification remains a local integrity violation rather than an active attack vector for privilege escalation.
Mitigation strategies primarily involve applying the upstream kernel patch that corrects the logic within ntfs_new_attr_flags to ensure that resident-to-non-resident conversion is triggered whenever sparse or compressed flags are set on attributes that require it. System administrators should prioritize updating their Linux kernels to versions where this fix has been integrated, ensuring that the NTFS driver correctly handles all edge cases related to attribute initialization. Additionally, implementing regular file system checks using tools like ntfsfix can help detect and repair any inconsistencies that may have already occurred in affected systems before they lead to significant data loss. For organizations running critical workloads on Linux-managed NTFS volumes, monitoring for unusual file size discrepancies or metadata errors during routine maintenance is recommended as a defensive measure against the residual effects of this vulnerability.