CVE-2026-99241: 
Linux Debian Schwachstellenanalyse und -minderung

CVE-2026-99241 is a race condition vulnerability in the Linux kernel's NTFS filesystem driver, specifically in the ntfs_filemap_page_mkwrite() function. The function calls iomap_page_mkwrite() without holding mapping->invalidate_lock, allowing concurrent truncate or fallocate operations to race with write fault handling. Affected versions include Linux kernel 7.1 through commits prior to the fixes (57c0d5281666d150c73e56e6795a4eef3ede8693 and 0fecc393f2060e6bc25138df32cb923ec7071c6b); kernel 7.2.14 and 7.3+ are unaffected. The vulnerability was published on November 2, 2026, with a CVSS estimate of Medium severity and an EPSS score of 0.0 (GitHub Advisory).

The root cause is a missing lock acquisition (CWE class: improper synchronization / race condition) in ntfs_filemap_page_mkwrite(), which calls iomap_page_mkwrite() without first acquiring mapping->invalidate_lock shared. Per Linux kernel documentation (Documentation/filesystems/locking.rst), the ->page_mkwrite() handler must serialize against truncate/invalidate operations using this lock. The race specifically involves ntfs_attr_fallocate(), which merges clusters into the in-memory runlist and drops the runlist lock before zeroing newly allocated clusters on disk, as well as punch-hole/insert/collapse paths that free clusters after cache truncation. Other filesystems such as XFS correctly acquire the equivalent mmaplock (the invalidate_lock rwsem) in shared mode during this path; the NTFS driver was the only one bypassing it (GitHub Advisory).

A local user with write access to an NTFS-formatted filesystem can trigger this race condition through concurrent write faults and truncate/fallocate operations, potentially causing data corruption, inconsistent filesystem state, or denial of service (system crash or hang). The vulnerability affects the integrity and availability of data on NTFS volumes; confidentiality impact is considered low. The attack is limited to local access and does not directly enable privilege escalation or lateral movement (GitHub Advisory).

There is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the publication date. The attack vector is local, requiring the attacker to have write access to an NTFS filesystem and the ability to trigger concurrent filesystem operations. The EPSS score is 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog (GitHub Advisory).

The fix involves taking invalidate_lock shared around the iomap_page_mkwrite() call in ntfs_filemap_page_mkwrite(), mirroring the approach used by XFS. Patched commits are 57c0d5281666d150c73e56e6795a4eef3ede8693 and 0fecc393f2060e6bc25138df32cb923ec7071c6b in the stable kernel tree; kernel versions 7.2.14 and 7.3+ include the fix. Until a patched kernel is applied, administrators should limit concurrent write fault and truncate/fallocate operations on NTFS filesystems where feasible, or avoid mounting untrusted NTFS volumes on affected kernel versions (GitHub Advisory, Kernel Patch 1, Kernel Patch 2).