Linux Kernel CVE-2026-98140

Exploitation requires local access to a system actively using the Linux NTFS filesystem driver for writes, specifically reaching write_mft_record_nolock() and hitting one of its error paths - a pre_write_mst_fixup() failure or a bio_add_folio() failure - which then leaks the kmap_local_folio() mapping. Limiting factors: the attacker must be local (AV:L) and hold at least low privileges (PR:L) sufficient to mount/write an NTFS volume; the trigger depends on these error conditions occurring, and the available sources do not describe them as attacker-controllable, so deliberate triggering is not established. Impact is limited to availability (kernel mapping-nesting corrupion / DoS); there is no confidentiality or integrity impact.

This is a low-to-moderate real-world risk that does not warrant emergency prioritization. The input CVSS of 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) correctly frames this as a local, availability-only issue with no confidentiality or integrity impact - consistent with CWE-401 (memory leak). The intelligence signals align coherently rather than conflict: EPSS is very low (0.14%, 3rd percentile), there is no CISA KEV listing, and no public exploit is identified - only upstream patch commits are referenced. The vuln.today decision label is 'this_month' (routine patching), not act_now or emergency, which matches the signal set. The one disagreement worth stating explicitly is the metadata tag 'Information Disclosure': the CVSS vector sets C:N (no confidentiality impact) and the bug is a kmap_local reference leak that corrupts stack-ordered local mappings, which is an availability/stability problem, not disclosure - treat the 'Information Disclosure' tag as unreliable. Overall this is a genuine kernel robustness fix rather than a priority threat, with exploitability further limited to local actors who can exercise the NTFS write path and hit specific error conditions.

A local user with the ability to trigger NTFS write operations (writing to a mounted, writable NTFS filesystem) causes write_mft_record_nolock() to hit the pre_write_mst_fixup() or bio_add_folio() failure path, leaking a kmap_local mapping and corrupting the per-task stack-ordered mapping nesting. This can destabilize subsequent kernel mapping operations, leading to denial of service. No public exploit is identified at time of analysis, and the error paths are not described as attacker-controlled, so reliable triggering is uncertain.