{"id":"CVE-2026-99242","title":"ntfs: fix race between fallocate and mmap reads","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nntfs: fix race between fallocate and mmap reads\n\nThe fallocate implementation only takes invalidate_lock for punch hole,\ncollapse range, and insert range operations. Fo…","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= 495e90fa334828d4119061e2726af51d0a0fb4ed < 7dd1c2fec6ebdd1a88a02cb58ff515a258eeb327","Linux >= 495e90fa334828d4119061e2726af51d0a0fb4ed < 67aded1da114dc44808315f249bd9e7e440f799d","Linux 7.1"],"published":"2026-11-02","updated":"2026-11-02","sourceUpdated":"2026-11-02T16:06:44.590Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-99242","references":[{"url":"https://git.kernel.org/stable/c/7dd1c2fec6ebdd1a88a02cb58ff515a258eeb327"},{"url":"https://git.kernel.org/stable/c/67aded1da114dc44808315f249bd9e7e440f799d"}],"tags":["cve.org"],"epss":0.00145,"epssPercentile":0.03797,"ingestedAt":"2026-11-05T19:30:42.703Z","slug":"CVE-2026-99242","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nntfs: fix race between fallocate and mmap reads\n\nThe fallocate implementation only takes invalidate_lock for punch hole,\ncollapse range, and insert range operations. For standard allocation modes\n(mode == 0, FALLOC_FL_KEEP_SIZE), the lock is not held.\n\nDuring ntfs_attr_fallocate(), new clusters are mapped to the runlist via\nntfs_attr_map_cluster() before being zeroed by ntfs_dio_zero_range(). This\ncreates a window where concurrent mmap page faults can read uninitialized\ndisk data.\n\nSince mmap uses filemap_fault() which takes invalidate_lock in shared mode,\nit can fault in pages during this window and expose old disk contents to\nuserspace. This is an information leak and data integrity issue.\n\nFix by taking invalidate_lock for all fallocate operations, not just for\npunch/collapse/insert modes. This prevents concurrent page faults from\naccessing unzeroed clusters during the allocation window.\n\n## Affected\n\n- `Linux >= 495e90fa334828d4119061e2726af51d0a0fb4ed < 7dd1c2fec6ebdd1a88a02cb58ff515a258eeb327`\n- `Linux >= 495e90fa334828d4119061e2726af51d0a0fb4ed < 67aded1da114dc44808315f249bd9e7e440f799d`\n- `Linux 7.1`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}