---
id: CVE-2026-99241
title: 'ntfs: take invalidate_lock in ntfs_filemap_page_mkwrite()'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  ntfs: take invalidate_lock in ntfs_filemap_page_mkwrite()

  ntfs_filemap_page_mkwrite() calls iomap_page_mkwrite() without holding
  mapping->invalidate_lock, so a concurr…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 9c87959601e80b39a45250e362e6ddfec17cb0fa <
    57c0d5281666d150c73e56e6795a4eef3ede8693
  - >-
    Linux >= 9c87959601e80b39a45250e362e6ddfec17cb0fa <
    0fecc393f2060e6bc25138df32cb923ec7071c6b
  - Linux 7.1
published: '2026-11-02'
updated: '2026-11-02'
sourceUpdated: '2026-11-02T16:06:44.163Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-99241'
references:
  - url: 'https://git.kernel.org/stable/c/57c0d5281666d150c73e56e6795a4eef3ede8693'
  - url: 'https://git.kernel.org/stable/c/0fecc393f2060e6bc25138df32cb923ec7071c6b'
tags:
  - cve.org
epss: 0.00154
epssPercentile: 0.04561
ingestedAt: '2026-11-05T19:30:42.702Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

ntfs: take invalidate_lock in ntfs_filemap_page_mkwrite()

ntfs_filemap_page_mkwrite() calls iomap_page_mkwrite() without holding
mapping->invalidate_lock, so a concurrent truncate or fallocate can be
in the middle of invalidating pagecache and rewriting the runlist while
the write fault maps blocks and dirties the folio.  This races with
ntfs_attr_fallocate(), which merges clusters into the in-memory
runlist, drops the runlist lock, and only afterwards zeroes the newly
allocated clusters on disk; and with the punch-hole/insert/collapse
paths that free clusters after truncating the cache.

Per Documentation/filesystems/locking.rst, ->page_mkwrite() must ensure
there are no truncate/invalidate races, "usually mapping->invalidate_lock
is suitable for proper serialization".  xfs takes its mmaplock (= the
invalidate_lock rwsem) shared in exactly this path.

Take invalidate_lock shared around iomap_page_mkwrite().  The read-only
fault path is already covered because filemap_fault() itself grabs
invalidate_lock shared on instantiation/read paths; only page_mkwrite
was bypassing it in this driver.

## Affected

- `Linux >= 9c87959601e80b39a45250e362e6ddfec17cb0fa < 57c0d5281666d150c73e56e6795a4eef3ede8693`
- `Linux >= 9c87959601e80b39a45250e362e6ddfec17cb0fa < 0fecc393f2060e6bc25138df32cb923ec7071c6b`
- `Linux 7.1`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.