CVE-2026-98140
ntfs: fix kmap_local leak in write_mft_record_nolock() error paths
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 7.2.7
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
In the Linux kernel, the following vulnerability has been resolved: ntfs: fix kmap_local leak in write_mft_record_nolock() error paths write_mft_record_nolock() maps the MFT record folio with kmap_local_folio(), but the pre_write_mst_fixup() and bio_add_folio() failure paths jump to the error label without unmapping it. kmap_local mappings are stack-ordered per task, so leaking one corrupts the nesting for any outer mapping. Unmap the folio on those error paths too.
Timeline
- CVE published
- Record last updated
Affected versions
- Linux Linux
From 115380f9a2f9675c7924563cbba70d40cae8fb81 · fixed in 5d7f7bf8fba8cf563b42b44aa4ab3d9928ac480c; From 115380f9a2f9675c7924563cbba70d40cae8fb81 · fixed in cf06dcd572845723821b54a608fc2da995c3c8e2
- Linux Linux
7.1
- KernelLinux
From 7.1.0 · fixed in 7.2.7