DEBIAN-CVE-2026-99102: Debian/linux vulnerability
In the Linux kernel, the following vulnerability has been resolved: ntfs: take invalidatelock in ntfssetattrsize() ntfssetattrsize() updates isize and resizes the on-disk attribute without holding mapping->invalidatelock. Page faults take the lock shared, so a fault racing the resize can resolve a VCN against the transient runlist state of ntfsnonresidentattrexpand() and fail with a spurious SIGBUS, and can interleave with the size-change epilogue (truncatepagecache(), isizewrite(), pagecacheisizeextended()). Take invalidatelock exclusively around the whole resize after inodediowait(), matching the fallocate path and other filesystems such as xfs, which wraps truncate in its mmaplock (= invalidatelock).
Affected Software
Event History
Frequently Asked Questions
Who is most likely to encounter this issue?
Systems using the Linux kernel NTFS code are affected when an NTFS file is resized while another process faults pages for that file. The problematic race involves concurrent file-size changes and memory-mapped or fault-driven access.
What must occur for the race to be triggered?
An NTFS file resize must race with a page fault accessing the same file. The page fault can observe a transient runlist state during non-resident attribute expansion, potentially resulting in a spurious SIGBUS.
What is the observed impact?
A process accessing the affected file can receive a spurious SIGBUS. The race can also interleave page-cache truncation and inode-size update operations during the resize.
What does the fix change?
The fix takes mapping->invalidate_lock exclusively for the entire NTFS resize operation after inode_dio_wait(). This prevents page faults, which take the lock in shared mode, from observing the transient resize state.