7.8
HighCVSS 3.1 · from Linux
CVE-2026-99107
ntfs: fix incorrect MFT record pointer passed to ntfs_attr_record_resize
LinuxAffectedLinux, Linux
FixUpdate to 0a9122cada749447dfb6d67aa3fed4ee1982231c, 8d139e3635c86e2c97c78d55538ce0b00b6d9986, 0, 7.2.13 or newer
PublishedOct 28, 10:34 · Linux
ScoredOct 28 · 7.8 · Linux
Exploit code publicNone known · checked 21:18 UTC
ExploitedNone known · CISA KEV checked 22:05 UTC
What we know
No known exploitation. CISA KEV, checked 22:05 UTC.
No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 21:18 UTC.
An attacker needs local access to the machine. CVSS: local.
A successful attack can read and change data and take the service down. CVSS: high impact on confidentiality, integrity and availability.
Description
In the Linux kernel, the following vulnerability has been resolved: ntfs: fix incorrect MFT record pointer passed to ntfs_attr_record_resize ntfs_new_attr_flags() passes the wrong MFT record to ntfs_attr_record_resize(). When the attribute is in an extent record, ctx->mrec points to the extent but the function receives the base record pointer m, causing incorrect size calculations in memmove. Fix by passing ctx->mrec (the actual MFT record containing the attribute) instead of m (the base MFT record) to ntfs_attr_record_resize().
From Linux
Affected and fixed versions
ProductAffectedFixed inLinuxfc053f05ca282a5e760b41f6560ac835c4e28037 – before 0a9122cada749447dfb6d67aa3fed4ee1982231c0a9122cada749447dfb6d67aa3fed4ee1982231cLinuxfc053f05ca282a5e760b41f6560ac835c4e28037 – before 8d139e3635c86e2c97c78d55538ce0b00b6d99868d139e3635c86e2c97c78d55538ce0b00b6d9986Linux7.1–LinuxNot affected0LinuxNot affected7.2.13LinuxNot affected7.3
Exploit code
Exploit-DBnone knownMetasploitnone knownNucleinone known