CVE-2026-99242: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-99242 is a race condition vulnerability in the Linux kernel's NTFS filesystem implementation that can lead to information disclosure. The flaw exists in the ntfs_attr_fallocate() function, which fails to hold invalidate_lock during standard allocation operations (mode == 0, FALLOC_FL_KEEP_SIZE), creating a window where concurrent mmap page faults can read uninitialized disk data. It affects Linux kernel version 7.1 through commits prior to the fix (patched in 7.2.14 and 7.3). The CVSS base score has not been formally assigned, but Feedly estimates the severity as Medium (GitHub Advisory, Feedly).

The root cause is a time-of-check/time-of-use (TOCTOU) race condition (related to CWE-362: Concurrent Execution Using Shared Resource with Improper Synchronization) in the Linux kernel NTFS driver. During ntfs_attr_fallocate(), new clusters are mapped to the runlist via ntfs_attr_map_cluster() before being zeroed by ntfs_dio_zero_range(). Because invalidate_lock is not held for standard allocation modes, a concurrent mmap operation using filemap_fault() — which only acquires invalidate_lock in shared mode — can fault in pages during this window and expose stale, uninitialized disk contents to userspace. The fix extends invalidate_lock coverage to all fallocate operation modes, not just punch hole, collapse range, and insert range (GitHub Advisory).

Successful exploitation allows a local user with access to an NTFS-formatted filesystem to read uninitialized disk data containing previously stored information that should not be accessible — constituting an information leak. The vulnerability affects confidentiality by exposing old disk contents to userspace, and also poses a data integrity concern during the allocation window. The impact is limited to local users and does not directly enable privilege escalation or remote code execution, but sensitive data (e.g., previously deleted file contents) could be disclosed (GitHub Advisory, Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the disclosure date. The EPSS score is 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires local access to a system with an NTFS filesystem mounted and the ability to simultaneously invoke fallocate and mmap on the same file (GitHub Advisory, Feedly).

1. Gain local access: Obtain a local user account on a Linux system with an NTFS filesystem mounted (e.g., via ntfs3 or legacy ntfs driver).
2. Identify a target file: Select or create a file on the NTFS filesystem that is subject to fallocate operations.
3. Set up concurrent threads: Write a program that spawns two concurrent threads — one calling fallocate(fd, 0, offset, len) (standard allocation, mode == 0) on the target file, and another mapping the file into memory via mmap().
4. Trigger the race window: The fallocate thread maps new clusters via ntfs_attr_map_cluster() before zeroing them. During this window, the mmap thread triggers a page fault via filemap_fault(), which reads the uninitialized cluster data.
5. Read stale disk data: The mmap thread reads the faulted-in page, which may contain old disk contents (e.g., previously deleted file data) that have not yet been overwritten by ntfs_dio_zero_range().
6. Exfiltrate disclosed data: Scan the read memory region for sensitive information such as credentials, keys, or file fragments from previously stored data (GitHub Advisory).

Apply the kernel patch that extends invalidate_lock protection to all fallocate operation modes. The fix is available in Linux kernel 7.2.14 (stable) and 7.3, corresponding to commits 7dd1c2fec6ebdd1a88a02cb58ff515a258eeb327 and 67aded1da114dc44808315f249bd9e7e440f799d. As a temporary workaround, administrators can restrict local user access to NTFS filesystems or avoid mounting NTFS volumes until the patch is applied (GitHub Advisory, Kernel Patch 1, Kernel Patch 2).