Linux Kernel NTFS EUVD-2026-86970

Requires local access as a low-privileged user to a volume mounted with the legacy in-kernel NTFS driver with write support (not ntfs3), plus a cluster-free operation spanning multiple runmap runs (deleting or truncating a fragmented file). The buggy count only inflates when ntfs_bitmap_clear_run() actually fails for a run - e.g. a second run failing with the same errno as an earlier one, or any failure after a prior non-ENOMEM error - so an error path (memory pressure, I/O/media error) must be hit. Limiting factors: local-only vector, requires writable NTFS mount using the legacy driver, and depends on a bitmap-clear failure that an attacker cannot deterministically control, so normal operation on healthy media does not trigger it.

This is a low-priority, defense-in-depth correctness fix rather than an actively dangerous vulnerability. The CVSS 3.1 base score is 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), meaning local access, low privileges, no user interaction, and an availability-only impact with no confidentiality or integrity loss. EPSS corroborates the low urgency at 0.18% (7th percentile), there is no CISA KEV listing, and no public exploit was identified - all three exploitation signals agree that real-world exploitation is improbable. The underlying defect is an accounting bug: ntfs_cluster_free_from_rl_nolock() inflates vol->free_clusters by a run's length even when ntfs_bitmap_clear_run() failed and rolled back, corrupting statfs output and the allocator's free-space gate. I assess the input CVSS AC:L as optimistic - the faulty branch only executes when a bitmap clear actually fails (e.g. ENOMEM or an I/O error after a prior non-ENOMEM error), a condition an attacker cannot reliably force, so this is better characterized as AC:H. Note also the 'Information Disclosure' tag conflicts with the CVSS vector (C:N) and the description, which describes metadata/availability corruption, not data disclosure - the tag appears mislabeled.

A local, low-privileged user with write access to a mounted NTFS volume deletes or truncates fragmented files, triggering multi-run cluster frees. If the bitmap clear fails mid-operation (e.g. under memory pressure or on media errors), the kernel still credits the failed run's length to the free-cluster count, silently corrupting reported and enforced free space. No public exploit exists, and the trigger depends on an error condition rather than attacker-controlled input, making reliable exploitation impractical.