CVE-2026-99241

A flaw was found in the Linux kernel's NTFS file system driver. A local user can cause a Denial of Service (DoS) or file system corruption by exploiting a race condition between concurrent memory-mapped write operations and file truncation or allocation. Because the driver omits proper synchronization locks when handling write page faults, concurrent operations can invalidate memory mappings prematurely and lead to a system crash.

This vulnerability is rated as Moderate impact because exploitation requires local access and write permissions on an active NTFS mount, and the resulting impact is confined to a local denial of service or filesystem corruption without code execution. In typical Red Hat Enterprise Linux deployments, NTFS is neither mounted by default nor used for system partitions, significantly restricting exposure. An attacker must execute carefully timed concurrent memory-mapped writes and file allocation or truncation calls on an existing NTFS filesystem to trigger the race.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.