Linux kernel NTFS driver: Incorrect pointer handling leads to memory corruption
Summary
The in-kernel NTFS driver (fs/ntfs) passes the base MFT record instead of the extent record to ntfs_attr_record_resize() when a new attribute is stored in an extent record. This leads to incorrect size calculations in a memmove operation. A local user with low privileges who can get a crafted NTFS volume mounted and modified may be able to corrupt kernel memory, which can lead to a crash or privilege escalation. Systems that use ntfs-3g (FUSE) or do not mount NTFS volumes are not affected by this code path.
Affected
- Linux kernel from commit fc053f05ca28 (introduced in 7.1) up to the fix in 7.2.13 and in the 7.3 development line before the fix
- Stable tree commits: 0a9122cada749447dfb6d67aa3fed4ee1982231c and 8d139e3635c86e2c97c78d55538ce0b00b6d9986
- Distribution kernels: unknown, check the vendor changelog
Fixed in
- Linux kernel 7.2.13 (per OSV)
- Fix merged into the NTFS maintainer's 7.3-rc2 pull request
- Fixed distribution kernel versions: Unknown.
Workaround
- Do not mount untrusted NTFS volumes read-write.
- On servers that do not need NTFS access, blacklist the ntfs module.
- No vendor workaround confirmed.
Exploitation
- No reports of exploitation in the wild found.
- No public proof of concept found.
- EPSS: 0.16 % (percentile 5).
Our recommendation
- Apply the kernel update from your distribution as soon as it contains the fix (commit IDs above).
- Prioritise Linux hosts that mount NTFS media such as USB sticks, external drives or dual-boot partitions (medium priority).
- Restrict NTFS mounting to trusted users and media on affected systems.
- Servers that never mount NTFS have low exposure; apply the update in the normal patch cycle.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Linux stable commit 0a9122cada749447dfb6d67aa3fed4ee1982231c git.kernel.org
- Linux stable commit 8d139e3635c86e2c97c78d55538ce0b00b6d9986 git.kernel.org
- Ubuntu security tracker CVE-2026-99107 ubuntu.com
- Debian CVE tracker DEBIANCVE-2026-99107 vulners.com
- OSV BELL-CVE-2026-99107 osv.dev
- Patch submission for the stable tree ratatoskr.run
- NTFS maintainer pull request 7.3-rc2 ratatoskr.run
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 22:04.
Original description (NVD)
In the Linux kernel, the following vulnerability has been resolved: ntfs: fix incorrect MFT record pointer passed to ntfs_attr_record_resize ntfs_new_attr_flags() passes the wrong MFT record to ntfs_attr_record_resize(). When the attribute is in an extent record, ctx->mrec points to the extent but the function receives the base record pointer m, causing incorrect size calculations in memmove. Fix by passing ctx->mrec (the actual MFT record containing the attribute) instead of m (the base MFT record) to ntfs_attr_record_resize().
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.