UBUNTU-CVE-2026-99241: Medium severity ubuntu/linux vulnerability
In the Linux kernel, the following vulnerability has been resolved: ntfs: take invalidatelock in ntfsfilemappagemkwrite() ntfsfilemappagemkwrite() calls iomappagemkwrite() without holding mapping->invalidatelock, so a concurrent truncate or fallocate can be in the middle of invalidating pagecache and rewriting the runlist while the write fault maps blocks and dirties the folio. This races with ntfsattrfallocate(), which merges clusters into the in-memory runlist, drops the runlist lock, and only afterwards zeroes the newly allocated clusters on disk; and with the punch-hole/insert/collapse paths that free clusters after truncating the cache. Per Documentation/filesystems/locking.rst, ->pagemkwrite() must ensure there are no truncate/invalidate races, "usually mapping->invalidatelock is suitable for proper serialization". xfs takes its mmaplock (= the invalidatelock rwsem) shared in exactly this path. Take invalidatelock shared around iomappagemkwrite(). The read-only fault path is already covered because filemapfault() itself grabs invalidatelock shared on instantiation/read paths; only pagemkwrite was bypassing it in this driver.
Affected Software
Event History
Frequently Asked Questions
What conditions are needed to trigger this race?
The affected NTFS path requires a writable memory-mapped file fault to overlap with operations that invalidate page cache or alter allocation, such as truncate, fallocate, punch-hole, insert, or collapse operations. Read-only mapped faults are already serialized by filemap_fault().
Which systems are exposed?
The issue applies to the listed Ubuntu kernel packages when they are using the NTFS filesystem and workloads can concurrently write through memory mappings while performing the conflicting file-size or allocation operations. The provided data does not identify affected package versions or default NTFS configuration details.
What is the immediate mitigation if an updated kernel cannot be deployed?
Avoid concurrent writable mmap activity and truncate, fallocate, punch-hole, insert, or collapse operations on the same NTFS file. The fix serializes page_mkwrite with the mapping invalidate lock to prevent these races.