Incorrect calculation in Linux kernel - CVE-2026-99108
Published: October 29, 2026
Vulnerability identifier: #VU158479
CSH Severity: Low
CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-99108
CWE-ID: CWE-682
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local privileged user to corrupt stored data by causing allocated NTFS clusters to be discarded.
The vulnerability exists due to incorrect discard-range calculation in ntfs_trim_fs() in fs/ntfs/bitmap.c when processing free extents whose starts are not aligned to the device discard granularity. A local privileged user can trigger FITRIM processing of such an extent to cause the discard range to extend into allocated clusters and corrupt stored data.
Affected software
Linux kernel
How to mitigate CVE-2026-99108
Install security update from vendor's repository.
Linux kernel - update to 7.0 rc3