CVE-2026-99242

A flaw was found in the Linux kernel's NTFS file system implementation. A race condition between file space preallocation and memory-mapped file operations allows newly allocated storage blocks to be accessed before they are cleared. A local user can exploit this vulnerability by reading memory-mapped files during concurrent space allocation, leading to information disclosure of stale or uninitialized disk data.

This vulnerability is rated as Moderate impact for Red Hat products because exploitation requires existing local user access and permissions to write to an NTFS-formatted filesystem. Red Hat Enterprise Linux does not deploy NTFS as a primary filesystem, generally restricting its presence to optional removable media or secondary partitions. The flaw allows the disclosure of stale or uninitialized storage blocks during concurrent allocation operations, but does not provide privileges to execute arbitrary code or compromise system availability.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.