CVE-2026-99171

Что произошло

In the Linux kernel, the following vulnerability has been resolved: ntfs3: free the sbi after a grace period If the "nocase" mount option ntfs3 uses custom hash and dentry compare functions. Both access ntfs3 superblock private information in rcu pathwalk. ntfs_put_super() and ntfs3_kill_sb() drop the info without any rcu delay. A lookup that's still inside the filesystem when the last reference to the mount is dropped causes a UAF. With a pathwalk held up in ntfs_d_hash() while the last reference to the mount goes away: BUG: KASAN: slab-use-after-free in ntfs_nls_to_utf16+0x752/0x940 Read of size 8 at addr ff1100010453c850 by task walker/99 Call Trace: ntfs_nls_to_utf16+0x752/0x940 ntfs_d_hash+0x22b/0x500 link_path_walk+0x11ad/0x1d30 path_lookupat+0x63/0xb00 filename_lookup+0x1f1/0x5b0 vfs_statx+0xd7/0x3b0 [...] Allocated by task 95: __kmalloc_cache_noprof+0x249/0x560 ntfs_init_fs_context+0x2db/0x5a0 alloc_fs_context+0x52e/0xc70 [...] Freed by task 98: kfree+0x1db/0x5b0 deactivate_locked_super+0x9c/0xf0 cleanup_mnt+0x9f/0x130 task_work_run+0x131/0x250 The bug is currently masked by the grace period in namespace_unlock() for umount(2). Keep the necessary information until the filesystem private info is freed and free it with an rcu delay. ntfs3_free_sbi() now runs from an rcu callback and drops the upcase table via ntfs_put_shared(). So switch s_shared_lock over to spin_lock_bh(). Otherwise the callback can deadlock against a task holding the lock on the same cpu.

Что делать

dpkg-query -W -f='${Package}	${Version}\n'

rpm -qa --qf '%{NAME}\t%{VERSION}-%{RELEASE}\n'

Get-HotFix | Select-Object HotFixID, InstalledOn

Продукты и затронутые версии

{
  "status": "affected",
  "version": "a3a956c78efaa202b1d75190136671cf6e87bfbe",
  "lessThan": "c39150784a801dbbfaf4fbfa284cb610552a5039",
  "versionType": "git"
}

{
  "status": "affected",
  "version": "a3a956c78efaa202b1d75190136671cf6e87bfbe",
  "lessThan": "36e6753daf9bb64563dcb5a3bb22f7699d973fa2",
  "versionType": "git"
}

{
  "status": "affected",
  "version": "a3a956c78efaa202b1d75190136671cf6e87bfbe",
  "lessThan": "c8b1a4840467930e01f1a9374d991d7a8a2896c1",
  "versionType": "git"
}

{
  "status": "affected",
  "version": "a3a956c78efaa202b1d75190136671cf6e87bfbe",
  "lessThan": "7abecef26a9be8f9de70659a3092250461a52072",
  "versionType": "git"
}

{
  "status": "affected",
  "version": "a3a956c78efaa202b1d75190136671cf6e87bfbe",
  "lessThan": "c01b091b06412d3b1b53d8c2925f6de586c8a2fc",
  "versionType": "git"
}

{
  "status": "affected",
  "version": "6.2"
}

{
  "status": "unaffected",
  "version": "0",
  "lessThan": "6.2",
  "versionType": "semver"
}

{
  "status": "unaffected",
  "version": "6.6.161",
  "versionType": "semver",
  "lessThanOrEqual": "6.6.*"
}

{
  "status": "unaffected",
  "version": "6.12.115",
  "versionType": "semver",
  "lessThanOrEqual": "6.12.*"
}

{
  "status": "unaffected",
  "version": "6.18.59",
  "versionType": "semver",
  "lessThanOrEqual": "6.18.*"
}

{
  "status": "unaffected",
  "version": "7.2.13",
  "versionType": "semver",
  "lessThanOrEqual": "7.2.*"
}

{
  "status": "unaffected",
  "version": "7.3",
  "versionType": "original_commit_for_fix",
  "lessThanOrEqual": "*"
}

CVSS: оценки и векторы

Оценка CVSS отсутствует.

Источники и ссылки

{
  "cwes": [],
  "epss": {
    "source": "epss",
    "received_at": "2026-11-02T21:15:51.454388+00:00"
  },
  "title": {
    "source": "cve",
    "received_at": "2026-10-30T12:57:42.023831+00:00"
  },
  "scores": [],
  "status": {
    "source": "cve",
    "received_at": "2026-10-30T12:57:42.023831+00:00"
  },
  "affected": [
    "cve"
  ],
  "published": {
    "source": "cve",
    "received_at": "2026-10-30T12:57:42.023831+00:00"
  },
  "solutions": [],
  "percentile": {
    "source": "epss",
    "received_at": "2026-11-02T21:15:51.454388+00:00"
  },
  "references": [
    "cve",
    "ghsa",
    "nvd"
  ],
  "description": {
    "source": "cve",
    "received_at": "2026-10-30T12:57:42.023831+00:00"
  },
  "workarounds": [],
  "configurations": []
}

Хронология записи

1. Данные обновлены03.11.2026, 00:15
2. Данные обновлены02.11.2026, 00:13
3. Данные обновлены31.10.2026, 12:00
4. Данные обновлены30.10.2026, 15:58
5. Данные обновлены28.10.2026, 23:51
6. Данные обновлены28.10.2026, 18:00
7. Опубликована28.10.2026, 15:17

Личная заметка и статус

Другие CVE того же продукта