SB20261022115 - Race condition in Linux kernel ntfs3

Description

This security bulletin contains information about 1 vulnerability.

1) Race condition (CVE-ID: CVE-2026-98539)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service by indefinitely blocking operations on an NTFS3 directory.

The vulnerability exists due to a race condition in ntfs_create_inode() in the Linux kernel NTFS3 filesystem when exposing a new directory inode before its lock initialization is complete. A local user can race directory creation with a path lookup or mount operation to reset an inode lock while it is held, corrupt its state, and cause subsequent directory locking operations to block indefinitely.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/1abd643f3783ea8f8e273c18697ff0413aa92dc7
• https://git.kernel.org/stable/c/1ae2a242c15b03470b1b16289298e597bbe3bb29
• https://git.kernel.org/stable/c/37ec7353f4ac495b28284b0fcb0e53d21d1b3f3f
• https://git.kernel.org/stable/c/6fda7121cb6a8ea6fbd77d0f787f04b8e8b5358e