CVE-2026-90118 Linux Kernel CVE debrief

Who should care

Linux kernel developers and maintainers, Linux distribution vendors, and users of Linux systems with NTFS support should be aware of this vulnerability and take necessary actions to prevent potential data corruption or unauthorized access. They should review and apply the kernel patch, verify system updates, and monitor for potential exploitation attempts.

Why it matters

The CVE-2026-90118 vulnerability in the Linux kernel's ntfs_decompress() function requires prompt attention from Linux kernel developers, maintainers, and users of Linux systems with NTFS support to prevent potential data corruption or unauthorized access.

• Potential for data corruption or unauthorized access due to out-of-bounds writes.
• Need for prompt patching to prevent potential exploitation.
• Importance of monitoring systems for signs of exploitation attempts.

Technical summary

The ntfs_decompress() function in the Linux kernel does not properly check the destination address, leading to out-of-bounds writes when reading a corrupted compressed $DATA attribute. The function uses a per-token range check, but it does not break when the destination address equals the sub-block end, causing a write of one byte past the destination page. This vulnerability can be addressed by applying the kernel patch that fixes the off-by-one error in the ntfs_decompress() function, preventing out-of-bounds writes.

Defensive priority

High

Recommended defensive actions

• Review and apply the kernel patch to fix the off-by-one page overflow in ntfs_decompress().
• Verify that systems using the Linux kernel with NTFS support are updated with the patched version.
• Monitor for potential exploitation attempts targeting this vulnerability.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability in the Linux kernel's ntfs_decompress() function. The vulnerability allows for out-of-bounds writes when reading a corrupted compressed $DATA attribute. The official CVE Program record and NIST NVD detail page offer source-provided CVE metadata and vulnerability assessments. However, the current details are limited, and defenders should verify the affected scope, severity, and vendor guidance.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.