CVE-2026-90131 Linux CVE debrief

Who should care

Linux kernel developers and maintainers, as well as users of Linux systems that utilize NTFS filesystems, should be aware of this vulnerability and take steps to ensure their systems are patched.

Why it matters

The Linux kernel's NTFS implementation is vulnerable to a race condition that can cause data corruption or crashes when handling resident I/O operations. Linux kernel developers and maintainers, as well as users of Linux systems that utilize NTFS filesystems, should be aware of this vulnerability and take steps to ensure their systems are patched.

• Data corruption or crashes may occur when handling resident I/O operations on NTFS filesystems.
• The vulnerability can be exploited to cause denial-of-service conditions.
• Exploitation may allow for potential data tampering.

Technical summary

The Linux kernel's NTFS implementation is vulnerable to a race condition that can cause data corruption or crashes. The issue arises from the lack of proper synchronization between the `ntfs_read_iomap_begin_resident` function and the `ntfs_attr_record_resize` function. This allows a writer to modify the MFT record while a reader is accessing it, resulting in torn reads of attribute length and offset fields.

Defensive priority

Medium

Recommended defensive actions

• Review and apply the provided kernel patches to ensure the NTFS implementation is properly synchronized.
• Monitor Linux kernel updates for any related security patches.
• Consider implementing additional monitoring and logging to detect potential exploitation attempts.
• Perform a thorough review of system configurations and NTFS filesystem usage.
• Implement compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The vulnerability was reported by KCSAN and involves a data race between `ntfs_attr_find` and `ntfs_attr_record_resize`. The issue allows for torn reads of attribute length and offset fields during MFT record relocation.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.