CVE-2026-99108
UnknownSummary
In the Linux kernel NTFS filesystem, ntfs_trim_fs() aligns the start of a free extent up to the discard granularity but derives the discard length by aligning the original extent length down. When the extent start is not discard-aligned, the resulting discard range can extend past the free extent into allocated clusters, which get zeroed.
Risk Assessment
A FITRIM operation can irreversibly zero data in allocated clusters adjacent to a free extent, causing data loss. The issue affects systems with mismatched discard granularity alignment.
Recommendation
Update the Linux kernel to a version with the fix that aligns the absolute end of the extent down and skips extents without a full discard unit. Until patched, avoid running FITRIM on NTFS filesystems with mismatched alignment.
Other vulnerabilities in Linux kernel
See all- CVE-2026-58942High
In do_fault_around of memory.c, there is a possible use after free due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed.
- CVE-2026-58847Unknown
In kvm_vfio_pviommu_attach of vfio.c, there is a possible double free due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- CVE-2026-58829High
In fuse_backing_mmap of backing.c, there is a possible memory corruption due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed.
- CVE-2026-58828High
In multiple functions of base.c, there is a possible use-after-free due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed.
- CVE-2026-58827High
In multiple functions of dma-buf.c, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed.
- CVE-2026-58826High
In ksys_unshare of fork.c, there is a possible memory corruption due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed.
- CVE-2026-58825High
In multiple functions of fork.c, there is a possible use after free due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed.
- CVE-2026-99242Unknown
In the Linux kernel, a race between fallocate and mmap reads in NTFS was fixed. Fallocate only took invalidate_lock for punch hole, collapse range and insert range operations, and during standard allocation new clusters were mapped before being zeroed, allowing concurrent mmap page faults to read uninitialized disk data.
- CVE-2026-99241Unknown
In the Linux kernel, a missing lock in ntfs_filemap_page_mkwrite() was fixed; it called iomap_page_mkwrite() without holding mapping->invalidate_lock. A concurrent truncate or fallocate could be invalidating pagecache and rewriting the runlist while the write fault mapped blocks and dirtied the folio.
- CVE-2026-99240Unknown
In the Linux kernel, the DAMON subsystem (mm/damon/core) has a division-by-zero bug when a DAMOS quota goal has a target_value of zero. The fix moves handling of this corner case to the core layer by adding validation in damos_commit_quota_goal(), which now returns an error for zero target values.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: ntfs: fix FITRIM range alignment ntfs_trim_fs() aligns the start of a free extent up to the device discard granularity, but derives the discard length by aligning the original extent length down. When the free extent start is not discard-aligned, adding that length to the aligned start can extend the discard past the free extent and into allocated clusters. For example, with 4 KiB clusters and 32 KiB discard granularity, the free extent [4 KiB, 36 KiB) becomes the discard range [32 KiB, 64 KiB), so 28 KiB beyond the free extent may be discarded. Align the absolute end of the free extent down and derive the length from the two aligned endpoints. Skip extents that contain no full discard unit. Reproduced with a 4 KiB-cluster NTFS filesystem on scsi_debug configured for 32 KiB discard granularity and read-zero-after-trim. Before this change, FITRIM zeroed seven allocated 4 KiB clusters following an unaligned 32 KiB hole. With this change, the same data remains intact across FITRIM and remount.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS