CVE-2026-99171
Low risk· EPSS 7%Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
A use-after-free vulnerability exists in the Linux kernel's ntfs3 module. When the "nocase" mount option is used, dentry compare and hash functions access superblock private data in the RCU pathwalk, while ntfs_put_super() and ntfs3_kill_sb() free that data without an RCU delay. A lookup still inside the filesystem when the last mount reference is dropped causes a UAF.
Risk Assessment
The vulnerability can lead to a kernel crash (panic) or potentially kernel code execution, posing a serious threat to system stability and security. It requires local access and a mounted NTFS filesystem with the "nocase" option.
Recommendation
Update the Linux kernel to a version containing the fix (freeing sbi with an RCU delay and using spin_lock_bh() for s_shared_lock). Until patched, avoid mounting NTFS filesystems with the "nocase" option.
Other vulnerabilities in Linux kernel (ntfs3)
See all- CVE-2026-90048Critical
In the Linux kernel, ni_create_attr_list() in the ntfs3 filesystem has a slab-out-of-bounds write. The function allocates a fixed buffer of record_size bytes and writes one ATTR_LIST_ENTRY per attribute without checking the buffer end. A crafted NTFS image with many minimum-size nameless attributes can overflow the heap buffer.
- CVE-2026-98539Low risk· EPSS 10%
In the Linux kernel's ntfs3 filesystem, ntfs_create_inode() called d_instantiate() before unlock_new_inode(), causing a race between directory creation and mounting a filesystem on the same path. This reset the i_rwsem lock state (count and owner) while another thread already held it, triggering warnings in do_new_mount and potentially causing inode_lock() to hang indefinitely. The fix switches to d_instantiate_new() and removes the trailing unlock_new_inode().
- CVE-2025-37806Medium
In the Linux kernel, the ntfs3 filesystem lacks synchronization between write operations and ioctl calls that clear the file's compression flag. If a user clears the compression flag during a write, the kernel selects incorrect operations and triggers a NULL pointer dereference, causing a kernel oops.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: ntfs3: free the sbi after a grace period If the "nocase" mount option ntfs3 uses custom hash and dentry compare functions. Both access ntfs3 superblock private information in rcu pathwalk. ntfs_put_super() and ntfs3_kill_sb() drop the info without any rcu delay. A lookup that's still inside the filesystem when the last reference to the mount is dropped causes a UAF. With a pathwalk held up in ntfs_d_hash() while the last reference to the mount goes away: BUG: KASAN: slab-use-after-free in ntfs_nls_to_utf16+0x752/0x940 Read of size 8 at addr ff1100010453c850 by task walker/99 Call Trace: <TASK> ntfs_nls_to_utf16+0x752/0x940 ntfs_d_hash+0x22b/0x500 link_path_walk+0x11ad/0x1d30 path_lookupat+0x63/0xb00 filename_lookup+0x1f1/0x5b0 vfs_statx+0xd7/0x3b0 [...] Allocated by task 95: __kmalloc_cache_noprof+0x249/0x560 ntfs_init_fs_context+0x2db/0x5a0 alloc_fs_context+0x52e/0xc70 [...] Freed by task 98: kfree+0x1db/0x5b0 deactivate_locked_super+0x9c/0xf0 cleanup_mnt+0x9f/0x130 task_work_run+0x131/0x250 The bug is currently masked by the grace period in namespace_unlock() for umount(2). Keep the necessary information until the filesystem private info is freed and free it with an rcu delay. ntfs3_free_sbi() now runs from an rcu callback and drops the upcase table via ntfs_put_shared(). So switch s_shared_lock over to spin_lock_bh(). Otherwise the callback can deadlock against a task holding the lock on the same cpu.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS