CVE-2026-98136 is a high severity (CVSS 7.1) out of bounds read in the Linux kernel ntfs driver, in the function that walks the $AttrDef table. A crafted volume can trigger it when you create a file on it. Update to a kernel build that includes the fix and avoid mounting untrusted NTFS images.
What's affected
The record says the Linux kernel resolved this in the ntfs code. The function ntfs_attr_find_in_attrdef walks the in memory attribute definition table. Its loop condition checks only where each entry starts, not whether the whole entry lies inside the loaded table. A volume whose attribute definition data is smaller than one entry, the example given is 120 bytes, makes the code read past the end of its allocation.
The CVSS 3.1 vector is AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H, a score of 7.1. Local access and low privileges are needed, which fits mounting a crafted volume. Confidentiality and availability are rated high. KEV is false.
The record names two stable kernel commits as references, but the kernel.org pages returned an access error when we tried to read them, so we could not confirm which stable kernel releases carry the fix. Check your distribution's security tracker for the exact package version, and treat the record as the source for the description only.
How to check if you're exposed
Start by checking the running kernel with uname -r, and find out whether the in kernel ntfs driver is used on your systems. Run grep -i ntfs /proc/filesystems to see which NTFS drivers are registered, and lsmod to see whether a module is loaded. Many systems use a userspace driver such as ntfs-3g instead, which is outside this record.
Next, ask where NTFS volumes come from. Laptops that mount USB drives, forensic and recovery workstations, and build servers that read Windows images are the main places where untrusted volumes are mounted.
Finally, look up your distribution's advisory for this CVE. The vendor page lists the first fixed package version for each release, which is more reliable than comparing upstream version numbers by hand.
What to do now
- Install the kernel update from your distribution that lists CVE-2026-98136 as fixed, and reboot into it.
- Until then, avoid mounting NTFS volumes from untrusted sources, and disable automatic mounting of removable media on shared machines.
- If you do not need in kernel NTFS support, blacklist the module through your modprobe configuration.
- For appliances and embedded devices, ask the vendor which kernel they ship and when it will carry the fix.
- Record the kernel versions across your fleet so the next kernel advisory is quick to triage.
Why it matters
The weakness type is CWE-125, an out of bounds read. The loop guard was too loose: it confirmed that the start of an entry was inside the table but then read fields further along in the same entry. The fix requires the whole entry to lie within the table size and rejects a table that is too small when the volume is mounted.
Filesystem drivers parse data written by someone else, which makes them a steady source of bugs like this one. The impact is local and needs a malicious volume, so this is mainly a concern for machines that mount media they did not create.
Kernel flaws rarely show up in package scanners, because the kernel is not a library in your application. Keeping an accurate inventory of kernel versions and driver use is what makes advisories like this one manageable.
Quick check
Do I need to worry if I use ntfs-3g?
The record concerns the kernel ntfs code. The userspace ntfs-3g driver is a separate program. Check your distribution advisory to see which driver your system actually uses.
Which kernel version contains the fix?
We could not read the kernel commit pages, so we cannot state a version. Check your distribution tracker or the stable kernel release notes for CVE-2026-98136.
Sources
Gold entry for CVE-2026-98136 Kernel stable commit 3e2ae47b, access error when read Kernel stable commit c8504fc1, listed in the record, not read
Last reviewed: 18 October 2026.
