DEBIAN-CVE-2026-99242: Debian/linux vulnerability

In the Linux kernel, the following vulnerability has been resolved: ntfs: fix race between fallocate and mmap reads The fallocate implementation only takes invalidatelock for punch hole, collapse range, and insert range operations. For standard allocation modes (mode == 0, FALLOCFLKEEPSIZE), the lock is not held. During ntfsattrfallocate(), new clusters are mapped to the runlist via ntfsattrmapcluster() before being zeroed by ntfsdiozerorange(). This creates a window where concurrent mmap page faults can read uninitialized disk data. Since mmap uses filemapfault() which takes invalidatelock in shared mode, it can fault in pages during this window and expose old disk contents to userspace. This is an information leak and data integrity issue. Fix by taking invalidatelock for all fallocate operations, not just for punch/collapse/insert modes. This prevents concurrent page faults from accessing unzeroed clusters during the allocation window.