{"id":"CVE-2026-98315","published":"2026-10-06T09:18:23.200","lastModified":"2026-10-07T07:17:08.617","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nntfs: protect runlist updates with the runlist lock\n\nntfs_non_resident_attr_shrink() calls runlist helpers that require the\nrunlist write lock, but did not hold it while freeing clusters and\ntruncating the runlist. Serialize those operations and the resident\nconversion with the runlist lock.\n\nntfs_attr_map_cluster() can merge a newly allocated run before updating\nmapping pairs. If the update fails, free the clusters and restore both\nthe in-memory runlist and on-disk mapping pairs from a saved runlist.\nMark the volume in error if either rollback step fails.","cvssScore":7.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwes":[],"vendors":[],"products":[],"references":[{"url":"https://git.kernel.org/stable/c/742797432e8c9b0dd54ecc523c185e26b09d79a0","tags":[]},{"url":"https://git.kernel.org/stable/c/91709ba5d6d709b2b663287b7e871e2c6b480502","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The Linux kernel's NTFS filesystem driver has a race condition where runlist updates are not properly protected by locks, potentially allowing attackers to corrupt filesystem metadata and gain arbitrary code execution or data manipulation capabilities.","exploitability":"Exploitation requires local user access with write permissions to an NTFS volume and is moderately difficult to achieve, requiring precise timing of filesystem operations during cluster allocation and runlist modifications.","blast_radius":"If exploited, this vulnerability could affect all systems running Linux kernels with NTFS support, potentially leading to complete filesystem corruption or privilege escalation across multiple user sessions.","remediation":"Apply the kernel patch for the specific fix in the ntfs3 driver, which is part of the Linux kernel version 6.10.1 or later, and ensure all systems are upgraded to at least kernel version 6.10.1.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["filesystem","kernel","privilege-escalation"],"model":"garnet-coder","analyzedAt":"2026-10-14T09:03:37.135Z"}}