# CVE-2026-98139: Linux kernel NTFS cluster free counting logic error

Source: https://junglewise.ai/threats/cve-2026-98139-in-the-linux-kernel-the-following-vulnerability-has-been-resolved  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-25. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-98139 · Severity: info · Published 2026-09-25

The Linux kernel's NTFS file system has a bug in cluster deallocation logic that incorrectly counts failed operations as successful, leading to corruption of free space accounting. This causes file system metadata to report inaccurate free storage and can break the allocator's free space checks, potentially affecting file system reliability.

Technologies: [Unknown Linux kernel](https://junglewise.ai/threats/technologies/unknown-linux-kernel). Vendors: [Unknown](https://junglewise.ai/threats/vendors/unknown).

## Quick answers

**Is CVE-2026-98139 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-98139 being exploited in the wild.

**How severe is CVE-2026-98139?** Informational severity, published 25 September 2026.

**Which products and versions are affected?** Unknown Linux kernel multiple versions through at least 6.9 and 7.0+ (fix applied to stable branches).

**Is there a fix for CVE-2026-98139?** A patch was published on 2026-08-21: upstream fix committed Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-98139 attacked?** It is attacked with local access, in an operating system.

**Am I affected by CVE-2026-98139?** Check whether you run Unknown Linux kernel at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The ntfs_cluster_free_from_rl_nolock() function in fs/ntfs/lcnalloc.c fails to properly verify that ntfs_bitmap_clear_run() succeeded before incrementing the nr_freed counter. When a bitmap clear operation fails and rolls back partial modifications, the failed run's length was still added to nr_freed, inflating vol->free_clusters. The fix ensures nr_freed is only incremented when the bitmap clear operation returns success (err == 0).

## Affected products

- <UNKNOWN> Linux kernel multiple versions through at least 6.9 and 7.0+ (fix applied to stable branches)

## Timeline

- 2026-09-25: disclosed
- 2026-08-21: patched: upstream fix committed
- 2026-09-21: other: fix merged into stable branches

## References

- [https://git.kernel.org/stable/c/7eb97d8828e7758b9c81277f7802e740a800f78a](https://git.kernel.org/stable/c/7eb97d8828e7758b9c81277f7802e740a800f78a)
- [https://git.kernel.org/stable/c/be9e89ccb8e52a3e4b67feeb03ebd8133091dc7e](https://git.kernel.org/stable/c/be9e89ccb8e52a3e4b67feeb03ebd8133091dc7e)

## Related threats

- [Linux kernel netfilter nft_byteorder multi-register bypass](https://junglewise.ai/threats/cve-2026-99285-in-the-linux-kernel-the-following-vulnerability-has-been-resolved)
- [Linux kernel GPIO null pointer dereference in shared GPIO lookup](https://junglewise.ai/threats/cve-2026-99257-in-the-linux-kernel-the-following-vulnerability-has-been-resolved)
- [Linux kernel NTFS race condition in page fault handler](https://junglewise.ai/threats/cve-2026-99241-in-the-linux-kernel-the-following-vulnerability-has-been-resolved)
- [Linux kernel i915 DMC firmware load address validation bypass](https://junglewise.ai/threats/cve-2026-99146-in-the-linux-kernel-the-following-vulnerability-has-been-resolved)
- [Linux kernel dm-integrity buffer overflow in inline mode](https://junglewise.ai/threats/cve-2026-99098-in-the-linux-kernel-the-following-vulnerability-has-been-resolved)