CVE-2026-99107High· 7.8▾ Twilight

ntfs: fix incorrect MFT record pointer passed to ntfs_attr_record_resize

In the Linux kernel, the following vulnerability has been resolved: ntfs: fix incorrect MFT record pointer passed to ntfs_attr_record_resize ntfs_new_attr_flags() passes the wrong MFT record to ntfs_attr_record_resize(). When the attri…

▾ Twilight zone — High severity, or a signal on a lesser flaw

Depth score43/ 100 · Moderate

impact 42.9 · likelihood 0 · exploitation 0

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.

…

Published

Oct 28, 2026

Updated

Oct 31, 2026

CVSS

7.8

Vendor

Linux

Product

Linux

CWE

—

Depth score

43 · Moderate

EPSS

0.12% · p2

Platforms

—

Source

CVEORG

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS history

Exploit-prediction probability, daily snapshots since Oct 29.

0.2% → 0.1%

Timeline

Disclosure to exploitation, from the record and what we observed since indexing it.

5 events · 9 days

Oct 28, 2026Published
Disclosed via CVEORG
Oct 29, 2026EPSS first tracked
0.2%
Oct 31, 2026Record revised
Last analysed / modified upstream
Nov 5, 2026CVSS changed
— → 7.8
Nov 5, 2026Severity changed
none → high

Linux #cve.org

Affected

Linux >= fc053f05ca282a5e760b41f6560ac835c4e28037 < 0a9122cada749447dfb6d67aa3fed4ee1982231c
Linux >= fc053f05ca282a5e760b41f6560ac835c4e28037 < 8d139e3635c86e2c97c78d55538ce0b00b6d9986
Linux 7.1

Full technical detail▾

Overview

In the Linux kernel, the following vulnerability has been resolved:

ntfs: fix incorrect MFT record pointer passed to ntfs_attr_record_resize

ntfs_new_attr_flags() passes the wrong MFT record to ntfs_attr_record_resize(). When the attribute is in an extent record, ctx->mrec points to the extent but the function receives the base record pointer m, causing incorrect size calculations in memmove.

Fix by passing ctx->mrec (the actual MFT record containing the attribute) instead of m (the base MFT record) to ntfs_attr_record_resize().

Affected

Linux >= fc053f05ca282a5e760b41f6560ac835c4e28037 < 0a9122cada749447dfb6d67aa3fed4ee1982231c
Linux >= fc053f05ca282a5e760b41f6560ac835c4e28037 < 8d139e3635c86e2c97c78d55538ce0b00b6d9986
Linux 7.1

Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

References

Change history

Field changes observed since this record was first indexed.

Nov 5, 2026CVSS — → 7.8
Nov 5, 2026Severity none → high

Related vulnerabilities

Connected by shared product, vendor, weakness, or advisory.

#cve.org

ntfs: fix incorrect MFT record pointer passed to ntfs_attr_record_resize

▾ Twilight zone — High severity, or a signal on a lesser flaw

Depth score43/ 100 · Moderate

impact 42.9 · likelihood 0 · exploitation 0

Overview

In the Linux kernel, the following vulnerability has been resolved:

ntfs: fix incorrect MFT record pointer passed to ntfs_attr_record_resize

Fix by passing ctx->mrec (the actual MFT record containing the attribute) instead of m (the base MFT record) to ntfs_attr_record_resize().