CVE-2026-98315

Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source

AV:LAttack vector, local

The trigger is a local ftruncate() on a file in a mounted NTFS volume, via ntfs_setattr_size()->ntfs_truncate_vfs()->__ntfs_attr_truncate_vfs()->ntfs_non_resident_attr_shrink(). That path frees clusters and calls ntfs_rl_truncate_nolock() without ni->runlist.lock. No remote protocol supplies the input; it is a locking defect on a well-formed volume.

AC:LAttack complexity, low

The attacker runs both sides of the race: one thread dirties and fsync()s the file, driving ntfs_writeback_range()->__ntfs_write_iomap_begin(), which walks and merges ni->runlist.rl under runlist.lock. Another thread repeatedly ftruncate()s the same file, reallocating or kvfree()ing rl without that lock. It can be retried at will.

PR:LPrivileges required, low

The attacker only needs an ordinary local account with write permission on a file in an already-mounted NTFS volume, as needed for setattr ATTR_SIZE and writeback. No capability is checked on this path.

UI:NUser interaction, none

No crafted image or victim mount is needed. The race works against any legitimately mounted NTFS volume, using only the attacker's own truncate and write/fsync calls on a file the attacker can already write.

S:UScope, unchanged

The memory corruption stays within the kernel's own security authority. No guest/host, IOMMU or sandbox boundary is crossed.

C:HConfidentiality impact, high

ntfs_rl_truncate_nolock() reallocates or frees the kvmalloc'd runlist array while writeback still holds a pointer into it, so the freed slab can be reclaimed and its contents read back as cluster mappings (LCNs). That can direct I/O at arbitrary disk clusters, and is a use-after-free read of kernel memory.

I:HIntegrity impact, high

The writeback path merges new runs into the freed or reallocated runlist array (heap use-after-free write). Concurrently, ntfs_cluster_free() and the shrink update the shared runlist and on-disk mapping pairs without serialization, corrupting both kernel heap memory and filesystem metadata.

A:HAvailability impact, high

Losing the race leads to a KASAN use-after-free or oops in the runlist walk, a double kvfree, or a corrupted runlist and mapping pairs that leave the volume inconsistent and can crash later lookups.