Linux Kernel Vulnerability in NTFS Handling by Vendor

CVE-2026-98137

What is CVE-2026-98137?

A vulnerability in the Linux kernel's NTFS handling creates a risk where a failure in zeroing operations is not properly acknowledged. The function ntfs_dio_zero_range() is designed to return an error in the event of a failure, but due to improper handling, errors could be ignored, leading to the potential inclusion of stale on-disk data. This flaw could enable unintended data exposure and affect the integrity of file operations within the NTFS file system. A revised error-checking mechanism has been implemented to correctly treat any nonzero return as an error, preventing further allocation attempts in such cases.

References