{"cve":"CVE-2026-99101","nvd":{"published":"2026-10-28T11:17:29.367","modified":"2026-10-28T11:17:29.367","status":"Received","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nntfs: move attribute payload before shrinking its record\n\nntfs_new_attr_flags() resizes the non-resident attribute record before\nmoving its name and mapping pairs to their shorter-header offsets when\ncompression or sparse state is cleared.\n\nShrinking the record first moves the following attribute over the tail of\nthe old record. The subsequent memmove() therefore copies bytes from that\nfollowing attribute instead of the old mapping pairs. Re-enabling\ncompression on an empty file persists those bytes as a malformed mapping\npairs array, which ntfsck reports as a missing or invalid run length.\n\nMove the payload before shrinking the record, while retaining the existing\nresize-before-move ordering when growing it.","cvss_v4":null,"cvss_v3":null,"cwes":[],"references":["https://git.kernel.org/stable/c/0ab6dc1ac4601c8d79e5448a024daed6b0c5ef64","https://git.kernel.org/stable/c/7dc2c524608039d1b082a0087f7aa0751edd4ffb"],"products":[],"source":"nvd","synced_at":"2026-10-28T11:37:51.394563875+00:00"},"epss":null,"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}