---
id: CVE-2026-98139
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  ntfs: only count successfully cleared runs when freeing clusters

  ntfs_cluster_free_from_rl_nolock() adds a run's length to nr_freed
  whenever the error bookkeeping cond…
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  ntfs: only count successfully cleared runs when freeing clusters

  ntfs_cluster_free_from_rl_nolock() adds a run's length to nr_freed
  whenever the error bookkeeping cond…
severity: medium
cvss: 5.5
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'
vendor: linux
product: linux_kernel
affected:
  - 'linux_kernel >= 7.1, < 7.2.7'
  - linux_kernel = 7.3
patched:
  - linux_kernel 7.2.7
published: '2026-09-25'
updated: '2026-10-08'
sourceUpdated: '2026-10-08T17:26:39.003'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-98139'
references:
  - url: 'https://git.kernel.org/stable/c/7eb97d8828e7758b9c81277f7802e740a800f78a'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/be9e89ccb8e52a3e4b67feeb03ebd8133091dc7e'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
  - cve.org
epss: 0.00132
epssPercentile: 0.02741
ingestedAt: '2026-09-25T11:06:38.810Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

ntfs: only count successfully cleared runs when freeing clusters

ntfs_cluster_free_from_rl_nolock() adds a run's length to nr_freed
whenever the error bookkeeping condition is false, which includes
cases where ntfs_bitmap_clear_run() actually failed - e.g. a second
run failing with the same errno as an earlier one, or any failure
after a non-ENOMEM error was already recorded. Since a failed
ntfs_bitmap_clear_run() rolls back its partial modifications, no
bits were cleared for that run, yet its length still inflates
vol->free_clusters, corrupting statfs output and the allocator's
free space gate.

Only count runs whose bitmap clear succeeded.

## Affected

- `linux_kernel >= 7.1, < 7.2.7`
- `linux_kernel = 7.3`

## Remediation

Upgrade past the affected range:

- `linux_kernel 7.2.7`