Linux Kernel CVE-2026-43127

The vulnerability requires four specific conditions: (1) Local system access with user-level (unprivileged) credentials to execute filesystem operations; (2) An NTFS partition actively mounted on the target Linux system; (3) Concurrent execution of operations that trigger both ntfs_extend_mft() (expanding the MFT) and run_unpack_ex() (unpacking run lists), which typically occurs during file creation or metadata updates on a nearly-full NTFS volume; (4) The ntfs3 driver must be compiled into the kernel or loaded as a module (default in most distributions). The deadlock is triggered by specific timing and operation sequences, not all NTFS operations. Systems using ext4, Btrfs, XFS, or other non-NTFS filesystems are unaffected. The vulnerability does not exist in NTFS volumes accessed via ntfs-3g (userspace FUSE driver) because userspace threading has different lock semantics.

While the CVSS score of 5.5 indicates moderate severity, the real-world risk is significantly constrained by multiple factors. The EPSS score of 0.02% (percentile 4%) is exceptionally low, suggesting minimal likelihood of exploitation in practice. Exploitation requires local system access (AV:L) with low-privilege user credentials (PR:L), and the impact is availability denial only (denial of service), with no confidentiality or integrity compromise (C:N/I:N/A:H). The attack is deterministic but not trivial to trigger reliably. The vulnerability was not listed in CISA KEV at time of analysis, and no public exploit code is known, suggesting limited practical weaponization. Linux distributions with automatic kernel updates will mitigate this quickly. For systems with unattended long-running workloads handling NTFS filesystems, the denial-of-service impact (potential system hang) could be operationally significant, but the likelihood remains low due to the combination of local access requirement and specific timing conditions. This is a real kernel stability issue but not a security priority for most deployments.

A local user on a Linux system with NTFS partitions mounted could repeatedly perform file operations on the NTFS volume while concurrently triggering MFT (Master File Table) extension operations, such as creating files in a nearly-full NTFS partition. The kernel deadlock between the run_lock and bitmap lock could cause the filesystem thread to hang, degrading overall system responsiveness or causing a complete system hang if critical services depend on the affected filesystem. The attack requires local login access and knowledge that NTFS is mounted, making it a low-probability but plausible DoS vector in multi-user systems.