Linux Kernel: race in ntfs_filemap_page_mkwrite() causes truncate/fallocate bugs
CVE-2026-99241 Published on November 2, 2026
ntfs: take invalidate_lock in ntfs_filemap_page_mkwrite()
In the Linux kernel, the following vulnerability has been resolved:
ntfs: take invalidate_lock in ntfs_filemap_page_mkwrite()
ntfs_filemap_page_mkwrite() calls iomap_page_mkwrite() without holding
mapping->invalidate_lock, so a concurrent truncate or fallocate can be
in the middle of invalidating pagecache and rewriting the runlist while
the write fault maps blocks and dirties the folio. This races with
ntfs_attr_fallocate(), which merges clusters into the in-memory
runlist, drops the runlist lock, and only afterwards zeroes the newly
allocated clusters on disk; and with the punch-hole/insert/collapse
paths that free clusters after truncating the cache.
Per Documentation/filesystems/locking.rst, ->page_mkwrite() must ensure
there are no truncate/invalidate races, "usually mapping->invalidate_lock
is suitable for proper serialization". xfs takes its mmaplock (= the
invalidate_lock rwsem) shared in exactly this path.
Take invalidate_lock shared around iomap_page_mkwrite(). The read-only
fault path is already covered because filemap_fault() itself grabs
invalidate_lock shared on instantiation/read paths; only page_mkwrite
was bypassing it in this driver.
Products Associated with CVE-2026-99241
Want to know whenever a new CVE is published for Linux Kernel? stack.watch will email you.
Affected Versions
Linux:- Version 9c87959601e80b39a45250e362e6ddfec17cb0fa and below 57c0d5281666d150c73e56e6795a4eef3ede8693 is affected.
- Version 9c87959601e80b39a45250e362e6ddfec17cb0fa and below 0fecc393f2060e6bc25138df32cb923ec7071c6b is affected.
- Version 7.1 is affected.
- Before 7.1 is unaffected.
- Version 7.2.14, <= 7.2.* is unaffected.
- Version 7.3, <= * is unaffected.