SB20261029211 - Incorrect behavior order in Linux kernel ntfs

Description

This security bulletin contains information about 1 vulnerability.

1) Incorrect behavior order (CVE-ID: CVE-2026-99101)

CWE-ID: CWE-696 - Incorrect Behavior Order

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to corrupt NTFS file attribute metadata.

The vulnerability exists due to incorrect operation ordering in ntfs_new_attr_flags() in fs/ntfs/ea.c when clearing compression or sparse state on a non-resident attribute. A local user can trigger attribute record shrinking followed by payload relocation, causing bytes from the following attribute to replace the original mapping pairs, and then re-enable compression on an empty file to persist a malformed mapping pairs array.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/0ab6dc1ac4601c8d79e5448a024daed6b0c5ef64
• https://git.kernel.org/stable/c/7dc2c524608039d1b082a0087f7aa0751edd4ffb