CVE-2026-98135

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ntfs: reject invalid sectors_per_cluster in the boot sector

is_boot_sector_ntfs() checks the boot sector's sectors_per_cluster field

with a range test that rejects 0x81..0xf3 but accepts 0 and other

non-power-of-two counts. A zero value reaches parse_ntfs_boot_sector():

sectors_per_cluster_bits = ffs(sectors_per_cluster) - 1;

...

vol->cluster_size = vol->sector_size << sectors_per_cluster_bits;

ffs(0) is 0, so sectors_per_cluster_bits becomes (unsigned)-1 and the

shift is undefined:

UBSAN: shift-out-of-bounds in fs/ntfs/super.c:673:39

shift exponent 4294967295 is too large for 32-bit type 'int'

This change rejects any non-power-of-two value, since it feeds the

aforementioned shift via ffs() - 1, which only yields the correct shift for a

power of two.

/// Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// Affected products

/// References