Linux Kernel up to 7.2.6/7.3-rc1 NTFS update_reparse_data return value

Summaryinfo

A vulnerability described as problematic has been identified in Linux Kernel up to 7.2.6/7.3-rc1. The impacted element is the function update_reparse_data of the component NTFS. Such manipulation leads to return value. This vulnerability is listed as CVE-2026-98141. The attack may be performed from remote. There is no available exploit. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in Linux Kernel up to 7.2.6/7.3-rc1. Affected by this issue is the function update_reparse_data of the component NTFS. The manipulation with an unknown input leads to a return value vulnerability. Using CWE to declare the problem leads to CWE-252. The product does not check the return value from a method or function, which can prevent it from detecting unexpected states and conditions. Impacted is integrity, and availability. CVE summarizes:

In the Linux kernel, the following vulnerability has been resolved: ntfs: propagate reparse index insertion failure update_reparse_data() ignores the return value of set_reparse_index(). When index insertion fails, the code removes the just-written reparse data as cleanup but still returns 0, so symlink(2) (and WSL special file creation) reports success while no reparse data exists on disk. When there was no previous reparse data (oldsize == 0), the failure was likewise silently ignored. Propagate the error to the caller.

The advisory is shared for download at git.kernel.org. This vulnerability is handled as CVE-2026-98141 since 09/25/2026. The exploitation is known to be easy. The attack may be launched remotely. Successful exploitation requires user interaction by the victim. There are known technical details, but no exploit is available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 09/25/2026).

Upgrading to version 7.2.7 or 7.3-rc2 eliminates this vulnerability. Applying the patch c62f446c63398dc7151f413069bf617032cf7a71/9692b1b4fc00cf89628bc43f71729ab21f14f8d3 is able to eliminate this problem. The best possible mitigation is suggested to be upgrading to the latest version.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

Version

• 7.2.0
• 7.2.1
• 7.2.2
• 7.2.3
• 7.2.4
• 7.2.5
• 7.2.6
• 7.3-rc1

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion