Skip to content
CVE Tracker
Back

CVE-2026-99241

ntfs: take invalidate_lock in ntfs_filemap_page_mkwrite()

Not scored
Published
Updated
Reserved
Assigned by
Linux

Description

In the Linux kernel, the following vulnerability has been resolved: ntfs: take invalidate_lock in ntfs_filemap_page_mkwrite() ntfs_filemap_page_mkwrite() calls iomap_page_mkwrite() without holding mapping->invalidate_lock, so a concurrent truncate or fallocate can be in the middle of invalidating pagecache and rewriting the runlist while the write fault maps blocks and dirties the folio. This races with ntfs_attr_fallocate(), which merges clusters into the in-memory runlist, drops the runlist lock, and only afterwards zeroes the newly allocated clusters on disk; and with the punch-hole/insert/collapse paths that free clusters after truncating the cache. Per Documentation/filesystems/locking.rst, ->page_mkwrite() must ensure there are no truncate/invalidate races, "usually mapping->invalidate_lock is suitable for proper serialization". xfs takes its mmaplock (= the invalidate_lock rwsem) shared in exactly this path. Take invalidate_lock shared around iomap_page_mkwrite(). The read-only fault path is already covered because filemap_fault() itself grabs invalidate_lock shared on instantiation/read paths; only page_mkwrite was bypassing it in this driver.

Scores

No CVSS score yet: neither the CNA, CISA nor NVD has scored this CVE. NVD status: Received.

EPSS (exploitation in 30 days)
Not scored

The list uses the assigner's score when there is one, then CISA's, then NVD's: Not scored.

Affected products

  • Linux · Linux

    • affected 9c87959601e80b39a45250e362e6ddfec17cb0fa – < 57c0d5281666d150c73e56e6795a4eef3ede8693
    • affected 9c87959601e80b39a45250e362e6ddfec17cb0fa – < 0fecc393f2060e6bc25138df32cb923ec7071c6b

  • Linux · Linux

    • affected 7.1
    • unaffected < 7.1
    • unaffected 7.2.14 – ≤ 7.2.*
    • unaffected 7.3 – ≤ *

References (2)

Sources

The same CVE in the primary databases and aggregators, to check against.

Record last updated .