SB2026092848 - Incorrect calculation in Linux kernel ntfs

Description

This security bulletin contains information about 1 vulnerability.

1) Incorrect calculation (CVE-ID: CVE-2026-98139)

CWE-ID: CWE-682 - Incorrect Calculation

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to corrupt NTFS free-space accounting.

The vulnerability exists due to incorrect accounting in ntfs_cluster_free_from_rl_nolock() when freeing NTFS cluster runs after ntfs_bitmap_clear_run() fails. A local user can trigger the freeing of cluster runs after a bitmap-clear failure to corrupt NTFS free-space accounting.

A failed bitmap-clear operation rolls back its partial modifications.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/7eb97d8828e7758b9c81277f7802e740a800f78a
• https://git.kernel.org/stable/c/be9e89ccb8e52a3e4b67feeb03ebd8133091dc7e