CVE-2026-98137: ntfs: treat any nonzero dio zero-range return as an error
In the Linux kernel, the following vulnerability has been resolved:
ntfs: treat any nonzero dio zero-range return as an error
ntfsdiozerorange() returns either 0 or a negative errno from blkdevissuezeroout(); it never returns a positive value. The zeroing failure check in ntfsattrfallocate() therefore never fired, so a failed zeroing operation was silently ignored: the loop kept going, the newly allocated clusters were folded into initializedsize and the write could succeed leaving stale on-disk data.
Treat any nonzero return as an error and abort the allocation.
Affected Software
Event History
Frequently Asked Questions
What conditions are required for stale data to be exposed?
A zeroing operation must fail while NTFS allocates clusters through ntfs_attr_fallocate(). The prior error check could ignore that failure, allow allocation to continue, and mark the clusters initialized even though they had not been zeroed.
What is the impact of the failed error handling?
A write can succeed after the failed zeroing operation, leaving stale on-disk data in newly allocated clusters. The issue affects confidentiality of data that should have been cleared before reuse.
What mitigation is available if the fix cannot be applied immediately?
The provided data does not identify a configuration workaround. Avoid relying on NTFS allocation paths that require zeroing newly allocated clusters until a kernel containing the fix is deployed.