UBUNTU-CVE-2026-99242: Medium severity ubuntu/linux vulnerability
In the Linux kernel, the following vulnerability has been resolved: ntfs: fix race between fallocate and mmap reads The fallocate implementation only takes invalidatelock for punch hole, collapse range, and insert range operations. For standard allocation modes (mode == 0, FALLOCFLKEEPSIZE), the lock is not held. During ntfsattrfallocate(), new clusters are mapped to the runlist via ntfsattrmapcluster() before being zeroed by ntfsdiozerorange(). This creates a window where concurrent mmap page faults can read uninitialized disk data. Since mmap uses filemapfault() which takes invalidatelock in shared mode, it can fault in pages during this window and expose old disk contents to userspace. This is an information leak and data integrity issue. Fix by taking invalidatelock for all fallocate operations, not just for punch/collapse/insert modes. This prevents concurrent page faults from accessing unzeroed clusters during the allocation window.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Take invalidate_lock for all fallocate operations, including standard allocation modes (mode == 0 and FALLOC_FL_KEEP_SIZE), to prevent concurrent mmap page faults from accessing unzeroed clusters.
Event History
Frequently Asked Questions
What conditions are required for exploitation?
An attacker needs to trigger a standard NTFS fallocate operation, including mode 0 or FALLOC_FL_KEEP_SIZE, while causing concurrent reads through an mmap mapping of the same file. The race occurs after new clusters are added to the runlist but before they are zeroed.
What is exposed if the race succeeds?
A concurrent mmap page fault can expose old, uninitialized disk contents to userspace. The issue can also affect data integrity.
Are punch-hole, collapse-range, and insert-range fallocate operations affected by the described race?
The description states that these operations already take invalidate_lock. The vulnerable window applies to standard allocation modes where that lock was not held.
Which Ubuntu kernel packages are identified as affected?
The listed packages are ubuntu/linux, ubuntu/linux-fips, ubuntu/linux-aws, ubuntu/linux-azure, ubuntu/linux-gcp, ubuntu/linux-oracle, ubuntu/linux-aws-fips, and ubuntu/linux-azure-fips.