Linux Kernel NTFS Vulnerability in EA Flag Handling

CVE-2026-98133

What is CVE-2026-98133?

A vulnerability in the Linux kernel's NTFS implementation affects the management of the HasEA flag during extended attribute operations. When attempting to set extended attributes, the kernel incorrectly updates the HasEA flag on failure, thus hiding existing on-disk extended attributes until the inode is cleared. This flaw occurs specifically in the ntfs_set_ea() function, where the update of the HasEA flag should only occur upon successful completion of the operation. Failures in this process can lead to data concealment and unexpected behavior in file handling.

References