CVE-2026-98140: ntfs: fix kmap_local leak in write_mft_record_nolock() error paths
In the Linux kernel, the following vulnerability has been resolved:
ntfs: fix kmaplocal leak in writemftrecordnolock() error paths
writemftrecordnolock() maps the MFT record folio with kmaplocalfolio(), but the prewritemstfixup() and bioaddfolio() failure paths jump to the error label without unmapping it. kmaplocal mappings are stack-ordered per task, so leaking one corrupts the nesting for any outer mapping.
Unmap the folio on those error paths too.
Affected Software
Event History
Frequently Asked Questions
What conditions are required to trigger the issue?
The affected code must map an NTFS MFT record folio in write_mft_record_nolock(), then encounter a failure from either pre_write_mst_fixup() or bio_add_folio(). Those error paths previously exited without unmapping the folio.
What is the impact of the leaked mapping?
A leaked kmap_local mapping corrupts the required stack ordering of local mappings for the current task. This can affect any outer mapping whose nesting depends on that ordering.
How can I determine whether a kernel contains the fix?
Inspect the write_mft_record_nolock() error paths for failures from pre_write_mst_fixup() and bio_add_folio(). A fixed version unmaps the folio on both of those paths before returning through the error handling.