CVE-2026-90134: ntfs: fix kmap_local_page() usage in compress
In the Linux kernel, the following vulnerability has been resolved:
ntfs: fix kmaplocalpage() usage in compress
Several compressed I/O paths discard the address returned by kmaplocalpage() and later access or unmap the page using pageaddress(). This is invalid for highmem pages, and local mappings must also be unmapped using the address returned by kmaplocalpage().
Map each destination page in ntfsdecompress() only while producing the current sub-block. Use memcpyfrompage(), memcpytopage(), and memzeropage() for the other page accesses. Remove unnecessary local mappings from ntfswritecb(), where pages are accessed through the vmap() mapping.
Event History
Frequently Asked Questions
Which deployments are most exposed to this issue?
Systems using the Linux NTFS code with compressed I/O paths are implicated, particularly when the affected pages are highmem pages. The invalid page-address access and unmapping behavior is specifically unsafe for highmem pages.
What conditions are required for the flaw to be exercised?
The affected compressed I/O paths must operate on pages mapped with kmap_local_page(). The failure condition involves discarding that returned local-mapping address and later accessing or unmapping the page through page_address().
What does the resolved fix change?
The fix maps destination pages in ntfs_decompress() only while producing the current sub-block and uses the address returned by kmap_local_page() for local mappings. Other page operations are changed to memcpy_from_page(), memcpy_to_page(), and memzero_page(), while unnecessary local mappings are removed from ntfs_write_cb().