EUVD-2026-86964
GHSA-f7v2-w5q3-wjf8
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain local shell on NTFS-mounted host
-
DeliveryIssue setxattr on target file
-
ExploitTrigger pre-qsize failure path
-
ExecutionHasEA flag wrongly cleared
-
ImpactEAs hidden until inode eviction
Vulnerability Assessment
| Exploitation Conditions | Requires: (1) an NTFS volume mounted through the Linux kernel ntfs3 driver - not present on default installs without NTFS media; (2) a local user able to invoke setxattr() on a file residing on that volume (PR:L); and (3) the ntfs_set_ea() operation must fail on an exit path reached before ea_info_qsize is updated. Limiting factors: no remote vector (AV:L), requires local authenticated access, requires the non-default presence of an NTFS filesystem, and impact is confined to transiently hiding existing EAs until inode eviction - no privilege escalation, data corruption, or disclosure. |
| Impact | This is a genuinely low-priority, local-only availability issue despite the moderate 5.5 CVSS. The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) confirms the flaw is reachable only by a local, authenticated (PR:L) user and produces no confidentiality or integrity impact - only availability (A:H), which here manifests as existing on-disk NTFS extended attributes (EAs) being transiently hidden after a failed setxattr until the inode is evicted. All exploitation signals point to low real-world risk: EPSS is 0.15% (4th percentile), the CVE is NOT in CISA KEV, and no public exploit code is referenced - no public exploit identified at time of analysis. There is no SSVC decision record in the input. One conflict worth flagging: the input Tags label this 'Information Disclosure,' but the official CVSS vector sets C:N (no confidentiality impact) and the description describes data being hidden (an availability/consistency problem), not disclosed - the tag appears mislabeled and should not drive prioritization. Bottom line: a correctness/robustness fix in the ntfs3 driver, not a security priority for most environments. |
| Exploit ScenarioDerived | A local unprivileged user on a system with an NTFS volume mounted via the kernel ntfs3 driver sets an extended attribute on a file, and the operation fails (e.g., due to resource limits or an invalid request) before ea_info_qsize is updated. The error path unconditionally calls NInoClearHasEA(), so the file's pre-existing on-disk EAs become invisible to userspace until the inode is evicted from cache. No public exploit code exists; exploitation requires only local access, not elevated privileges. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 08, 2026
Local availability degradation in the Linux kernel's NTFS extended-attribute handling allows an authenticated local user to transiently hide existing on-disk extended attributes (EAs) on a mounted NTFS volume. When ntfs_set_ea() fails on an exit path reached before ea_info_qsize is updated, the driver unconditionally calls NInoClearHasEA(), so pre-existing EAs become invisible through the ntfs3 driver until the affected inode is evicted; the assessed vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H reflects local, authenticated access with high availability impact and no confidentiality or integrity loss. EPSS is 0.15% (4th percentile) and no public exploit identified at time of analysis; exploitation requires the non-default presence of an NTFS volume, and this remains a genuinely low-priority, local-only availability issue.
RemediationAI
Vendor-released patch: update to Linux 7.2.7 or 7.3-rc2 (or a later release containing the fix), which incorporates the mainline commit ac727d86fb84bdc9626ba9c756c26767459f3083 and the stable backport 5811a08310754cbf4a1122c81d14c54b8873c35c; distributions should consume their own kernel errata once the backport lands, and the referenced commits can be cherry-picked by vendors maintaining older trees. Because the defect is only reachable on mounted NTFS volumes, interim compensating controls are straightforward: mount NTFS media read-only where writes are not required, since a read-only mount causes setxattr() to fail with EROFS before reaching the faulty ntfs_set_ea() exit path (trade-off: no write, rename, or attribute modification on that volume), and avoid auto-mounting untrusted or removable NTFS media on multi-user systems. Restricting local interactive access so that only trusted users can invoke setxattr() on NTFS-backed paths reduces the attack surface but does not eliminate the bug for those users, and note that the impact is transient - the stale HasEA state is cleared on inode eviction, so unmounting and remounting the affected volume restores attribute visibility without data loss. No vendor patch version should be assumed beyond those named above; consult https://nvd.nist.gov/vuln/detail/CVE-2026-98133 and the kernel.org stable commit URLs for the authoritative fix mapping, and note there is no indication of active exploitation requiring emergency change control.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw lives in the NTFS filesystem support in the Linux kernel, specifically in the extended-attribute write path (ntfs_set_ea()) used by the ntfs3 driver when handling setxattr() calls on files stored on an NTFS volume. NTFS tracks whether an inode carries extended attributes through a state flag (HasEA), which is normally kept consistent with the on-disk EA bookkeeping field ea_info_qsize. The vulnerable exit path updates that flag unconditionally, including when the operation has already failed before ea_info_qsize could be refreshed; the result is that NInoClearHasEA() marks an inode as having no EAs even though EAs are still present on disk, causing them to be hidden from the driver until inode eviction clears the stale in-memory state. No CWE identifier was supplied in the input data, but the root cause class is an error-handling/state-management defect: a cleanup path mutating persistent state based on a value that was never successfully computed. As with most NTFS-driver issues, the affected code is only reachable when an NTFS volume is actually mounted through the kernel driver, so default installations without NTFS media are not exposed, and the impact is confined to transient attribute visibility rather than corruption, disclosure, or privilege escalation.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Local setxattr by an authenticated user (AV:L/PR:L/AC:L); no confidentiality or integrity breach (C:N/I:N); existing EAs rendered temporarily inaccessible gives A:H.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionNVD
In the Linux kernel, the following vulnerability has been resolved:
ntfs: leave HasEA flag untouched on setxattr failure
In ntfs_set_ea(), the exit path unconditionally updates the HasEA flag based on ea_info_qsize. When an error occurs before ea_info_qsize is updated, NInoClearHasEA() hides existing on-disk EAs until the inode is evicted.
Only update the flag on success.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB