AZL-112619: CVE-2026-99260 affecting package kernel 6.6.159.1-1

Q: What conditions are required to trigger this issue?

The issue is triggered when sparse or compressed flags are set on an NTFS resident attribute. The affected path is in ntfs_new_attr_flags, where resident-to-non-resident conversion was skipped and the operation terminated.

Q: Which systems are exposed?

Systems using the Azure Linux kernel package at version 6.6.159.1-1 are identified as affected. Exposure depends on processing NTFS attributes through the affected flag-setting path.

Published Nov 3, 2026

Updated

In the Linux kernel, the following vulnerability has been resolved:

ntfs: fix resident conversion in ntfsnewattrflags

When setting sparse/compressed flags on a resident attribute, the function skipped the resident-to-non-resident conversion and terminated.

Affected Software

1 affected component

azure-linux/kernel<=6.6.159.1-1

Event History

Nov 3, 2026

Advisory Published

via OSV·12:17 PM

Data Sourced

via OSV·12:17 PM

DescriptionAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-99260

Frequently Asked Questions

What conditions are required to trigger this issue?

The issue is triggered when sparse or compressed flags are set on an NTFS resident attribute. The affected path is in ntfs_new_attr_flags, where resident-to-non-resident conversion was skipped and the operation terminated.

Which systems are exposed?

Systems using the Azure Linux kernel package at version 6.6.159.1-1 are identified as affected. Exposure depends on processing NTFS attributes through the affected flag-setting path.

AZL-112619: CVE-2026-99260 affecting package kernel 6.6.159.1-1

Affected Software

Event History

Child vulnerabilities

Frequently Asked Questions

What conditions are required to trigger this issue?

Which systems are exposed?

Company

Resources

Contact

Frequently Asked Questions

What conditions are required to trigger this issue?

Which systems are exposed?