{"id":"CVE-2026-99107","title":"ntfs: fix incorrect MFT record pointer passed to ntfs_attr_record_resize","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nntfs: fix incorrect MFT record pointer passed to ntfs_attr_record_resize\n\nntfs_new_attr_flags() passes the wrong MFT record to ntfs_attr_record_resize().\nWhen the attri…","severity":"high","cvss":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvssSource":"cna","vendor":"Linux","product":"Linux","affected":["Linux >= fc053f05ca282a5e760b41f6560ac835c4e28037 < 0a9122cada749447dfb6d67aa3fed4ee1982231c","Linux >= fc053f05ca282a5e760b41f6560ac835c4e28037 < 8d139e3635c86e2c97c78d55538ce0b00b6d9986","Linux 7.1"],"published":"2026-10-28","updated":"2026-10-31","sourceUpdated":"2026-10-31T12:42:53.060Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-99107","references":[{"url":"https://git.kernel.org/stable/c/0a9122cada749447dfb6d67aa3fed4ee1982231c"},{"url":"https://git.kernel.org/stable/c/8d139e3635c86e2c97c78d55538ce0b00b6d9986"}],"tags":["cve.org"],"epss":0.00121,"epssPercentile":0.01921,"ingestedAt":"2026-10-28T11:09:40.459Z","slug":"CVE-2026-99107","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nntfs: fix incorrect MFT record pointer passed to ntfs_attr_record_resize\n\nntfs_new_attr_flags() passes the wrong MFT record to ntfs_attr_record_resize().\nWhen the attribute is in an extent record, ctx->mrec points to the extent\nbut the function receives the base record pointer m, causing incorrect\nsize calculations in memmove.\n\nFix by passing ctx->mrec (the actual MFT record containing the attribute)\ninstead of m (the base MFT record) to ntfs_attr_record_resize().\n\n## Affected\n\n- `Linux >= fc053f05ca282a5e760b41f6560ac835c4e28037 < 0a9122cada749447dfb6d67aa3fed4ee1982231c`\n- `Linux >= fc053f05ca282a5e760b41f6560ac835c4e28037 < 8d139e3635c86e2c97c78d55538ce0b00b6d9986`\n- `Linux 7.1`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":43,"depthScoreParts":{"impact":42.9,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":233296,"id":"CVE-2026-99107","ts":1793896011494,"field":"cvss","old":null,"new":"7.8"},{"seq":233295,"id":"CVE-2026-99107","ts":1793896011494,"field":"severity","old":"none","new":"high"}]}