{"id":"CVE-2026-99241","published":"2026-11-02T16:17:49.907","lastModified":"2026-11-02T16:17:49.907","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nntfs: take invalidate_lock in ntfs_filemap_page_mkwrite()\n\nntfs_filemap_page_mkwrite() calls iomap_page_mkwrite() without holding\nmapping->invalidate_lock, so a concurrent truncate or fallocate can be\nin the middle of invalidating pagecache and rewriting the runlist while\nthe write fault maps blocks and dirties the folio.  This races with\nntfs_attr_fallocate(), which merges clusters into the in-memory\nrunlist, drops the runlist lock, and only afterwards zeroes the newly\nallocated clusters on disk; and with the punch-hole/insert/collapse\npaths that free clusters after truncating the cache.\n\nPer Documentation/filesystems/locking.rst, ->page_mkwrite() must ensure\nthere are no truncate/invalidate races, \"usually mapping->invalidate_lock\nis suitable for proper serialization\".  xfs takes its mmaplock (= the\ninvalidate_lock rwsem) shared in exactly this path.\n\nTake invalidate_lock shared around iomap_page_mkwrite().  The read-only\nfault path is already covered because filemap_fault() itself grabs\ninvalidate_lock shared on instantiation/read paths; only page_mkwrite\nwas bypassing it in this driver.","cvssScore":null,"cvssSeverity":null,"cvssVector":null,"cwes":[],"vendors":[],"products":[],"references":[{"url":"https://git.kernel.org/stable/c/0fecc393f2060e6bc25138df32cb923ec7071c6b","tags":[]},{"url":"https://git.kernel.org/stable/c/57c0d5281666d150c73e56e6795a4eef3ede8693","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":null}