CVE-2026-90131

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ntfs: serialize resident iomap reads with mrec_lock

ntfs_read_iomap_begin_resident() walks the MFT record through

ntfs_attr_lookup() -> ntfs_attr_find() without taking ni->mrec_lock,

while ntfs_attr_record_resize(), ntfs_make_room_for_attr() and

ntfs_resident_attr_record_add() memmove() the same base_ni->mrec buffer

under that lock. map_mft_record() only takes a reference and does not

serialize, so the reader can observe torn attribute length and offset

fields while a writer is relocating the records.

KCSAN reports the race between the mmap read fault path and both link()

and unlink():

BUG: KCSAN: data-race in ntfs_attr_find / ntfs_attr_record_resize

write to 0xffff888100af1018 of 4 bytes by task 96 on cpu 1:

ntfs_attr_record_resize+0xd2/0x130

ntfs_attr_record_rm+0xad/0x530

ntfs_delete+0x224/0x640

ntfs_unlink+0x14d/0x280

vfs_unlink+0x157/0x520

read to 0xffff888100af1018 of 4 bytes by task 95

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References