{"api_version":"1","generated_at":"2026-10-29T07:57:49+00:00","cve":"CVE-2026-99101","urls":{"html":"https://cve.report/CVE-2026-99101","api":"https://cve.report/api/cve/CVE-2026-99101.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-99101","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-99101"},"summary":{"title":"ntfs: move attribute payload before shrinking its record","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nntfs: move attribute payload before shrinking its record\n\nntfs_new_attr_flags() resizes the non-resident attribute record before\nmoving its name and mapping pairs to their shorter-header offsets when\ncompression or sparse state is cleared.\n\nShrinking the record first moves the following attribute over the tail of\nthe old record. The subsequent memmove() therefore copies bytes from that\nfollowing attribute instead of the old mapping pairs. Re-enabling\ncompression on an empty file persists those bytes as a malformed mapping\npairs array, which ntfsck reports as a missing or invalid run length.\n\nMove the payload before shrinking the record, while retaining the existing\nresize-before-move ordering when growing it.","state":"PUBLISHED","assigner":"Linux","published_at":"2026-10-28 11:17:29","updated_at":"2026-10-28 11:17:29"},"problem_types":[],"metrics":[],"references":[{"url":"https://git.kernel.org/stable/c/0ab6dc1ac4601c8d79e5448a024daed6b0c5ef64","name":"https://git.kernel.org/stable/c/0ab6dc1ac4601c8d79e5448a024daed6b0c5ef64","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/7dc2c524608039d1b082a0087f7aa0751edd4ffb","name":"https://git.kernel.org/stable/c/7dc2c524608039d1b082a0087f7aa0751edd4ffb","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-99101","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-99101","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 7dc2c524608039d1b082a0087f7aa0751edd4ffb git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 0ab6dc1ac4601c8d79e5448a024daed6b0c5ef64 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 7.2.13 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.2.13 7.2.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.3 * original_commit_for_fix","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["fs/ntfs/ea.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"7dc2c524608039d1b082a0087f7aa0751edd4ffb","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"0ab6dc1ac4601c8d79e5448a024daed6b0c5ef64","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"7.2.13","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["fs/ntfs/ea.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThanOrEqual":"7.2.*","status":"unaffected","version":"7.2.13","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.3","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.2.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.3","vulnerable":true}],"negate":false,"operator":"OR"}]}],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nntfs: move attribute payload before shrinking its record\n\nntfs_new_attr_flags() resizes the non-resident attribute record before\nmoving its name and mapping pairs to their shorter-header offsets when\ncompression or sparse state is cleared.\n\nShrinking the record first moves the following attribute over the tail of\nthe old record. The subsequent memmove() therefore copies bytes from that\nfollowing attribute instead of the old mapping pairs. Re-enabling\ncompression on an empty file persists those bytes as a malformed mapping\npairs array, which ntfsck reports as a missing or invalid run length.\n\nMove the payload before shrinking the record, while retaining the existing\nresize-before-move ordering when growing it."}],"providerMetadata":{"dateUpdated":"2026-10-28T10:34:16.583Z","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux"},"references":[{"url":"https://git.kernel.org/stable/c/7dc2c524608039d1b082a0087f7aa0751edd4ffb"},{"url":"https://git.kernel.org/stable/c/0ab6dc1ac4601c8d79e5448a024daed6b0c5ef64"}],"title":"ntfs: move attribute payload before shrinking its record","x_generator":{"engine":"bippy-1.2.0"}}},"cveMetadata":{"assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","assignerShortName":"Linux","cveId":"CVE-2026-99101","datePublished":"2026-10-28T10:34:16.583Z","dateReserved":"2026-09-25T10:25:14.391Z","dateUpdated":"2026-10-28T10:34:16.583Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-10-28 11:17:29","lastModifiedDate":"2026-10-28 11:17:29","problem_types":[],"metrics":[],"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"99101","Ordinal":"1","Title":"ntfs: move attribute payload before shrinking its record","CVE":"CVE-2026-99101","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"99101","Ordinal":"1","NoteData":"In the Linux kernel, the following vulnerability has been resolved:\n\nntfs: move attribute payload before shrinking its record\n\nntfs_new_attr_flags() resizes the non-resident attribute record before\nmoving its name and mapping pairs to their shorter-header offsets when\ncompression or sparse state is cleared.\n\nShrinking the record first moves the following attribute over the tail of\nthe old record. The subsequent memmove() therefore copies bytes from that\nfollowing attribute instead of the old mapping pairs. Re-enabling\ncompression on an empty file persists those bytes as a malformed mapping\npairs array, which ntfsck reports as a missing or invalid run length.\n\nMove the payload before shrinking the record, while retaining the existing\nresize-before-move ordering when growing it.","Type":"Description","Title":"ntfs: move attribute payload before shrinking its record"}]}}}