Information Leak Vulnerability in Linux Kernel ntfs by The Linux Foundation

CVE-2026-99242

What is CVE-2026-99242?

A vulnerability in the Linux kernel's ntfs file system allows for the potential exposure of uninitialized disk data due to improper handling of the fallocate operation. When new clusters are allocated, a timing window exists where concurrent mmap page faults might access unzeroed clusters before the allocation is completed. This leads to an information leak, risking data integrity by exposing old disk contents to the userspace. The issue has been mitigated by ensuring that the invalidate_lock is held during all fallocate operations, protecting against concurrent access during the allocation process.

References