Linux Kernel NTFS EUVD-2026-58961

Exploitation requires a Linux system running a kernel prior to 7.1.5 with the legacy ntfs driver (not ntfs3) in use and an NTFS volume actively mounted with write access. The race condition requires concurrent execution of two specific kernel writeback paths - inode writeback (ntfs_write_inode) and MFT folio writeback (ntfs_mft_writepages) - which naturally occur under sustained concurrent write I/O on a filesystem with extent MFT records (i.e., inodes with large attribute lists). Exploitation is limited by the following: (1) the legacy ntfs driver must be loaded, not the newer ntfs3 driver; (2) write access to the mounted NTFS filesystem is required to generate dirty extent records; (3) the race window is timing-sensitive, requiring sustained concurrent I/O to reliably trigger. Systems that mount NTFS read-only, use ntfs3, or do not mount NTFS at all are entirely unaffected. Network-based unauthenticated exploitation as implied by the NVD-assigned AV:N/PR:N vector is not supported by the description.

The NVD-assigned CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H scoring this 7.5 is inconsistent with the described mechanism. The deadlock is triggered entirely within a local VFS writeback code path - an attacker must have write access to an NTFS-mounted filesystem and must provoke concurrent I/O to race the two writeback paths. AV:N and PR:N are not defensible for a filesystem race condition; the vector should be AV:L at minimum, and likely AC:H given the timing dependency. EPSS at 0.20% (10th percentile) correctly captures the low exploitation likelihood. The vulnerability is not in CISA KEV. The tags include 'Information Disclosure', but the CVSS impact metrics (C:N/I:N/A:H) and description confirm the actual impact is denial of service (system hang), not information disclosure - the tags appear mislabeled. Real-world risk is further reduced because the legacy NTFS driver (not the newer ntfs3 driver) is rarely used in production; most modern Linux systems either use ntfs3 or do not mount NTFS at all. Overall, this is a low operational priority for most organizations despite the 7.5 base score.

A local user or process with write access to an NTFS volume (for example, on a dual-boot workstation or a NAS with NTFS data shares) writes large files containing many attributes, populating extent MFT records. Under concurrent I/O load - such as a background sync or archive operation - the kernel simultaneously triggers inode writeback (Path A) and MFT folio writeback (Path B). The two paths acquire their respective mutexes in opposite order; both stall waiting for the other, and the kernel thread pool deadlocks, hanging the system. No public exploit code has been identified; xfstests generic/113 can reliably reproduce the condition in a test environment.