CVE-2026-99102: ntfs: take invalidate_lock in ntfs_setattr_size()
In the Linux kernel, the following vulnerability has been resolved:
ntfs: take invalidatelock in ntfssetattrsize()
ntfssetattrsize() updates isize and resizes the on-disk attribute without holding mapping->invalidatelock. Page faults take the lock shared, so a fault racing the resize can resolve a VCN against the transient runlist state of ntfsnonresidentattrexpand() and fail with a spurious SIGBUS, and can interleave with the size-change epilogue (truncatepagecache(), isizewrite(), pagecacheisizeextended()).
Take invalidatelock exclusively around the whole resize after inodediowait(), matching the fallocate path and other filesystems such as xfs, which wraps truncate in its mmaplock (= invalidatelock).
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
In ntfs_setattr_size(), acquire mapping->invalidate_lock exclusively around the entire resize operation, including truncate_pagecache(), i_size_write(), inode_dio_wait(), and pagecache_isize_extended(), to prevent page faults from racing transient runlist state.