CVE-2026-99260: 
CBL Mariner 취약점 분석 및 완화

CVE-2026-99260 is a vulnerability in the Linux kernel's NTFS subsystem, specifically in the ntfs_new_attr_flags function, where setting sparse or compressed flags on a resident attribute causes the function to skip the required resident-to-non-resident conversion and terminate prematurely. It affects Linux kernel versions starting from 7.1 up to (but not including) 7.2.13, as well as Microsoft's Azure Linux 3 kernel package azl3_kernel_6.6.159.1-1. The vulnerability was published on November 3, 2026, with patches available in kernel versions 7.2.13 and 7.3. It carries a CVSS v3.1 base score of 3.3 (Low) (GitHub Advisory, Microsoft MSRC).

The root cause is an improper handling of attribute conversion logic within the ntfs_new_attr_flags function in the Linux kernel's NTFS driver. When a user attempts to set sparse or compressed flags on a resident NTFS attribute, the function fails to perform the mandatory resident-to-non-resident conversion before applying the flags, instead terminating early. This logic flaw can result in an inconsistent filesystem state. The vulnerability is exploitable locally by a user with write access to an NTFS filesystem (attack vector: local, privileges required: low, no user interaction needed). No CWE classification has been formally assigned, and no public proof-of-concept code is known to exist (GitHub Advisory, Feedly).

Successful exploitation can lead to filesystem corruption, data loss, or a local denial of service condition on systems mounting NTFS filesystems. The impact is limited to availability (low), with no confidentiality or integrity impact identified. The scope is unchanged, meaning the vulnerability does not enable privilege escalation or lateral movement beyond the affected NTFS filesystem (GitHub Advisory, Microsoft MSRC).

There is no evidence of active in-the-wild exploitation or publicly available proof-of-concept code for CVE-2026-99260. The EPSS score is approximately 0.177% (7th percentile), indicating a low probability of exploitation within 30 days. No threat actor attribution has been reported, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (GitHub Advisory).

Update the Linux kernel to version 7.2.13 or later (stable branch), or version 7.3 or later (mainline). The fixes are available via the upstream kernel commits c5434e86d6c5324990017ea043bc821d115132c8 and 7ed0028126b5a19f278183abbae2b3166d3ca9ac. As a workaround, restrict write access to NTFS filesystems to trusted users only, and avoid mounting untrusted NTFS volumes on affected kernel versions. Microsoft has also issued an update for the affected Azure Linux 3 kernel package (GitHub Advisory, Microsoft MSRC).