# CVE-2026-99241: Linux kernel NTFS race condition in page fault handler

Source: https://junglewise.ai/threats/cve-2026-99241-in-the-linux-kernel-the-following-vulnerability-has-been-resolved  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-02. Updated: 2026-11-02  
License: CC BY 4.0 with a link back

CVE-2026-99241 · Severity: info · Published 2026-11-02

The Linux kernel's NTFS filesystem has a synchronization bug where the page write fault handler can race with file truncation or preallocation operations, potentially leading to data corruption. An attacker with local access and the ability to perform concurrent file operations on an NTFS mount could corrupt in-memory file metadata or cause an inconsistency between cached and on-disk data.

Technologies: [Unknown Linux kernel](https://junglewise.ai/threats/technologies/unknown-linux-kernel). Vendors: [Unknown](https://junglewise.ai/threats/vendors/unknown).

## Quick answers

**Is CVE-2026-99241 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-99241 being exploited in the wild.

**How severe is CVE-2026-99241?** Informational severity, published 2 November 2026.

**Which products and versions are affected?** Unknown Linux kernel versions with NTFS support.

**Is there a fix for CVE-2026-99241?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-99241 attacked?** It is attacked with local access, in an operating system.

**Am I affected by CVE-2026-99241?** Check whether you run Unknown Linux kernel at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The ntfs_filemap_page_mkwrite() handler calls iomap_page_mkwrite() without holding mapping->invalidate_lock, allowing concurrent truncate/fallocate operations to invalidate pagecache and modify the runlist while write faults are mapping blocks. The race window exists with ntfs_attr_fallocate() which merges clusters, drops the runlist lock, then zeroes clusters on disk. The fix adds shared invalidate_lock acquisition around iomap_page_mkwrite() to serialize against exclusive-lock holders (truncate/fallocate paths).

## Affected products

- <UNKNOWN> Linux kernel versions with NTFS support

## Timeline

- 2026-11-02: disclosed

## References

- [https://git.kernel.org/stable/c/0fecc393f2060e6bc25138df32cb923ec7071c6b](https://git.kernel.org/stable/c/0fecc393f2060e6bc25138df32cb923ec7071c6b)
- [https://git.kernel.org/stable/c/57c0d5281666d150c73e56e6795a4eef3ede8693](https://git.kernel.org/stable/c/57c0d5281666d150c73e56e6795a4eef3ede8693)

## Related threats

- [Linux kernel netfilter nft_byteorder multi-register bypass](https://junglewise.ai/threats/cve-2026-99285-in-the-linux-kernel-the-following-vulnerability-has-been-resolved)
- [Linux kernel GPIO null pointer dereference in shared GPIO lookup](https://junglewise.ai/threats/cve-2026-99257-in-the-linux-kernel-the-following-vulnerability-has-been-resolved)
- [Linux kernel i915 DMC firmware load address validation bypass](https://junglewise.ai/threats/cve-2026-99146-in-the-linux-kernel-the-following-vulnerability-has-been-resolved)
- [Linux kernel dm-integrity buffer overflow in inline mode](https://junglewise.ai/threats/cve-2026-99098-in-the-linux-kernel-the-following-vulnerability-has-been-resolved)
- [Linux kernel GVE XSK buffer memory leak when stopping rings](https://junglewise.ai/threats/cve-2026-99047-in-the-linux-kernel-the-following-vulnerability-has-been-resolved)