CVE-2026-90199

A flaw was found in the Linux kernel's fs/ntfs3 file system driver. An issue in the mi_enum_attr() function, responsible for validating virtual cluster numbers (VCNs) for non-resident attributes, could allow a local attacker to craft a malformed on-disk attribute. This malformed attribute, with an out-of-range end VCN, could bypass validation checks due to an integer wraparound. This could lead to a denial of service or other undefined behavior within the kernel.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.