CVE-2026-98140: ntfs: fix kmap_local leak in write_mft_record_nolock() error paths

Published Sep 25, 2026
·
Updated

In the Linux kernel, the following vulnerability has been resolved:

ntfs: fix kmaplocal leak in writemftrecordnolock() error paths

writemftrecordnolock() maps the MFT record folio with kmaplocalfolio(), but the prewritemstfixup() and bioaddfolio() failure paths jump to the error label without unmapping it. kmaplocal mappings are stack-ordered per task, so leaking one corrupts the nesting for any outer mapping.

Unmap the folio on those error paths too.

Affected Software

1 affected component
Linux Linux kernel

Event History

Sep 25, 2026
CVE Published
via MITRE·10:36 AM
Data Sourced
via MITRE·10:36 AM
Description

Frequently Asked Questions

1

What conditions are required to trigger the issue?

The affected code must map an NTFS MFT record folio in write_mft_record_nolock(), then encounter a failure from either pre_write_mst_fixup() or bio_add_folio(). Those error paths previously exited without unmapping the folio.

2

What is the impact of the leaked mapping?

A leaked kmap_local mapping corrupts the required stack ordering of local mappings for the current task. This can affect any outer mapping whose nesting depends on that ordering.

3

How can I determine whether a kernel contains the fix?

Inspect the write_mft_record_nolock() error paths for failures from pre_write_mst_fixup() and bio_add_folio(). A fixed version unmaps the folio on both of those paths before returning through the error handling.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203