SB20261029204 - Incorrect calculation in Linux kernel ntfs

Description

This security bulletin contains information about 1 vulnerability.

1) Incorrect calculation (CVE-ID: CVE-2026-99108)

CWE-ID: CWE-682 - Incorrect Calculation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to corrupt stored data by causing allocated NTFS clusters to be discarded.

The vulnerability exists due to incorrect discard-range calculation in ntfs_trim_fs() in fs/ntfs/bitmap.c when processing free extents whose starts are not aligned to the device discard granularity. A local privileged user can trigger FITRIM processing of such an extent to cause the discard range to extend into allocated clusters and corrupt stored data.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/03c6ecc4b4b13a3901f207152451fdd2d82e40c4
• https://git.kernel.org/stable/c/5e87da8ba8d3d647d89c754912e45c1f1a3bfc2e