HIGH Introduced in 7.1
ntfs MftRecord Leak
CVE-2026-98140
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
01Description
In the Linux kernel, the following vulnerability has been resolved: ntfs: fix kmap_local leak in write_mft_record_nolock() error paths write_mft_record_nolock() maps the MFT record folio with kmap_local_folio(), but the pre_write_mst_fixup() and bio_add_folio() failure paths jump to the error label without unmapping it. kmap_local mappings are stack-ordered per task, so leaking one corrupts the nesting for any outer mapping. Unmap the folio on those error paths too.
02KernelScan AI Analysis
Risk summary
A missing cleanup in the NTFS filesystem driver's MFT record writeback path leaks a kernel virtual memory mapping on certain error paths, corrupting the per-task mapping stack and potentially leading to kernel memory corruption. The bug is reachable when writing MFT records on a mounted NTFS volume, which requires root privileges to mount but can also be triggered via removable media on systems with automount enabled. Products with exposed USB or SD/MMC ports and automount are at elevated risk from crafted filesystem images.
Vulnerability analysis
When the NTFS driver writes a file-system metadata record to disk, it temporarily maps the record's page into kernel virtual memory. On two error paths — when internal consistency fixup fails or when the page cannot be added to the I/O request — the code continues to error handling without releasing that mapping. Because these mappings are tracked per task in stack order, a leaked entry corrupts the nesting sequence, causing later unmap operations to remove the wrong entry. This can leave pages accessible after they should have been released, or unmap pages that are still in use. The fix adds the missing unmap call on both affected error paths before continuing to shared error handling. The vulnerable code is reached during metadata writeback on a mounted NTFS volume; any local user with write access to the file system can trigger the write path, and systems with automount enabled and exposed removable media ports may also be affected by a crafted device inserted without authentication.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 7.2 | 7.1 | 7.2.7 | 5d7f7bf8fba8 |
| mainline | 7.1 | 7.3 | cf06dcd57284 |