---
id: CVE-2026-99107
title: 'ntfs: fix incorrect MFT record pointer passed to ntfs_attr_record_resize'
summary: >-
  In the Linux kernel, the following vulnerability has been resolved:


  ntfs: fix incorrect MFT record pointer passed to ntfs_attr_record_resize


  ntfs_new_attr_flags() passes the wrong MFT record to
  ntfs_attr_record_resize().

  When the attri…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= fc053f05ca282a5e760b41f6560ac835c4e28037 <
    0a9122cada749447dfb6d67aa3fed4ee1982231c
  - >-
    Linux >= fc053f05ca282a5e760b41f6560ac835c4e28037 <
    8d139e3635c86e2c97c78d55538ce0b00b6d9986
  - Linux 7.1
published: '2026-10-28'
updated: '2026-10-31'
sourceUpdated: '2026-10-31T12:42:53.060Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-99107'
references:
  - url: 'https://git.kernel.org/stable/c/0a9122cada749447dfb6d67aa3fed4ee1982231c'
  - url: 'https://git.kernel.org/stable/c/8d139e3635c86e2c97c78d55538ce0b00b6d9986'
tags:
  - cve.org
epss: 0.00121
epssPercentile: 0.01921
ingestedAt: '2026-10-28T11:09:40.459Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

ntfs: fix incorrect MFT record pointer passed to ntfs_attr_record_resize

ntfs_new_attr_flags() passes the wrong MFT record to ntfs_attr_record_resize().
When the attribute is in an extent record, ctx->mrec points to the extent
but the function receives the base record pointer m, causing incorrect
size calculations in memmove.

Fix by passing ctx->mrec (the actual MFT record containing the attribute)
instead of m (the base MFT record) to ntfs_attr_record_resize().

## Affected

- `Linux >= fc053f05ca282a5e760b41f6560ac835c4e28037 < 0a9122cada749447dfb6d67aa3fed4ee1982231c`
- `Linux >= fc053f05ca282a5e760b41f6560ac835c4e28037 < 8d139e3635c86e2c97c78d55538ce0b00b6d9986`
- `Linux 7.1`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.