Linux Kernel CVE-2026-98315

Requires that the Linux NTFS driver be loaded and an NTFS volume be mounted and accessible to the attacker, who must already have local access (AV:L) and some privilege level (PR:L) sufficient to perform file/attribute operations on that volume. The specific vulnerable paths are ntfs_non_resident_attr_shrink() (cluster freeing and runlist truncation without the runlist write lock) and ntfs_attr_map_cluster() (merging a newly allocated run before a mapping-pairs update that may fail), so exploitation depends on reaching those operations - notably a failing mapping-pairs update and the resulting rollback window. LIMITING FACTORS: no remote vector (local only), the NTFS driver and a mounted NTFS volume must be present (not a default on most Linux servers), and the root cause is a locking race, so a concurrent/timing-dependent trigger is likely needed, reducing reliability. No user interaction is required (UI:N).

Signals are consistent and point to a genuine but NOT urgent local-only issue. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8 HIGH) describes a local, already-authenticated attacker with full CIA impact and no scope change - a classic local privilege-escalation / kernel-corruption profile rather than a remotely reachable flaw. EPSS is very low (0.16%, 5th percentile) and the vulnerability is NOT in CISA KEV, with no public exploit code referenced, so there is no evidence of active or imminent exploitation. One point of tension to verify: the input Tags label this 'Information Disclosure', but the description and CVSS (I:H/A:H) describe an unsynchronized runlist/cluster-freeing race that corrupts in-memory and on-disk NTFS mapping-pairs - that is primarily a memory-corruption/integrity-and-availability bug, not pure disclosure, so treat the 'Information Disclosure' framing with caution. Separately, the upstream vector uses AC:L, but because the root cause is a missing runlist write lock (a race window during a failed mapping-pairs update/merge), real-world triggering plausibly requires concurrent operations and specific timing, which argues for higher attack complexity than AC:L suggests - verify against the actual trigger conditions. Net: a legitimate kernel hardening fix worth patching in normal cycles, not a drop-everything priority for most fleets, and only relevant where the NTFS driver is actually in use.

A local, low-privileged user with access to a mounted NTFS volume issues concurrent file operations that drive ntfs_non_resident_attr_shrink()/ntfs_attr_map_cluster() through the unlocked runlist-update and failed-mapping-pairs-rollback paths, racing to corrupt the in-memory runlist and on-disk mapping pairs. The resulting kernel memory/filesystem-metadata corruption can be steered toward privilege escalation, or at minimum trigger a kernel crash (DoS). No public exploit code was identified, and exploitation requires winning a timing-dependent race on a system where the NTFS driver is loaded and a volume is accessible.