CVE-2026-98133: ntfs: leave HasEA flag untouched on setxattr failure
In the Linux kernel, the following vulnerability has been resolved:
ntfs: leave HasEA flag untouched on setxattr failure
In ntfssetea(), the exit path unconditionally updates the HasEA flag based on eainfoqsize. When an error occurs before eainfoqsize is updated, NInoClearHasEA() hides existing on-disk EAs until the inode is evicted.
Only update the flag on success.
Affected Software
Event History
Frequently Asked Questions
When can this issue be triggered?
It occurs when ntfs_set_ea() encounters an error before ea_info_qsize is updated. The failure path can then clear the HasEA flag even though extended attributes already exist on disk.
What is the practical effect on an affected system?
Existing on-disk extended attributes can be hidden for the affected inode until that inode is evicted. The issue is caused by incorrect in-memory HasEA flag handling after a failed extended-attribute update.
How can administrators determine whether a system includes the fix?
Check whether the kernel incorporates either referenced stable commit: 5811a08310754cbf4a1122c81d14c54b8873c35c or ac727d86fb84bdc9626ba9c756c26767459f3083. The fix changes ntfs_set_ea() so the HasEA flag is updated only after a successful operation.