CVE-2026-99241

Dashboard / Vulnerabilities / CVE-2026-99241

CVE-2026-99241

Summary: ntfs: take invalidate_lock in ntfs_filemap_page_mkwrite()

Details: In the Linux kernel, the following vulnerability has been resolved: ntfs: take invalidate_lock in ntfs_filemap_page_mkwrite() ntfs_filemap_page_mkwrite() calls iomap_page_mkwrite() without holding mapping->invalidate_lock, so a concurrent truncate or fallocate can be in the middle of invalidating pagecache and rewriting the runlist while the write fault maps blocks and dirties the folio. This races with ntfs_attr_fallocate(), which merges clusters into the in-memory runlist, drops the runlist lock, and only afterwards zeroes the newly allocated clusters on disk; and with the punch-hole/insert/collapse paths that free clusters after truncating the cache. Per Documentation/filesystems/locking.rst, ->page_mkwrite() must ensure there are no truncate/invalidate races, "usually mapping->invalidate_lock is suitable for proper serialization". xfs takes its mmaplock (= the invalidate_lock rwsem) shared in exactly this path. Take invalidate_lock shared around iomap_page_mkwrite(). The read-only fault path is already covered because filemap_fault() itself grabs invalidate_lock shared on instantiation/read paths; only page_mkwrite was bypassing it in this driver.

References: https://git.kernel.org/stable/c/0fecc393f2060e6bc25138df32cb923ec7071c6b, https://git.kernel.org/stable/c/57c0d5281666d150c73e56e6795a4eef3ede8693, https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/99xxx/CVE-2026-99241.json, https://nvd.nist.gov/vuln/detail/CVE-2026-99241, https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git