{
  "cveId": "CVE-2026-90131",
  "url": "https://patchblox.com/security/cve/CVE-2026-90131",
  "summary": "CVE-2026-90131 is fixed in linux on 1 platform by DEBIAN-CVE-2026-90131 (version 7.2.6-1), released September 23, 2026. It is not reported as exploited. Patch Radar priority: High.",
  "title": "linux: In the Linux kernel, the following vulnerability has been resolved:  ntfs: serialize resident iomap reads with mrec_l...",
  "description": "In the Linux kernel, the following vulnerability has been resolved:  ntfs: serialize resident iomap reads with mrec_lock  ntfs_read_iomap_begin_resident() walks the MFT record through ntfs_attr_lookup() -\u003E ntfs_attr_find() without taking ni-\u003Emrec_lock, while ntfs_attr_record_resize(), ntfs_make_room_for_attr() and ntfs_resident_attr_record_add() memmove() the same base_ni-\u003Emrec buffer under that lock. map_mft_record() only takes a reference and does not serialize, so the reader can observe torn attribute length and offset fields while a writer is relocating the records.  KCSAN reports the race between the mmap read fault path and both link() and unlink():    BUG: KCSAN: data-race in ntfs_attr_find / ntfs_attr_record_resize    write to 0xffff888100af1018 of 4 bytes by task 96 on cpu 1:    ntfs_attr_record_resize\u002B0xd2/0x130    ntfs_attr_record_rm\u002B0xad/0x530    ntfs_delete\u002B0x224/0x640    ntfs_unlink\u002B0x14d/0x280    vfs_unlink\u002B0x157/0x520    read to 0xffff888100af1018 of 4 bytes by task 95 on cpu 0:    ntfs_attr_find\u002B0x104/0x5b0    ntfs_attr_lookup\u002B0x39c/0x10c0    ntfs_read_iomap_begin_resident\u002B0xc6/0x230    ntfs_read_iomap_begin\u002B0x5d/0xa0    iomap_iter\u002B0x2e2/0x6e0    iomap_read_folio\u002B0x147/0x2a0    ntfs_read_folio\u002B0x108/0x170    filemap_read_folio\u002B0x35/0x100    filemap_fault\u002B0x993/0x1000    value changed: 0x00000250 -\u003E 0x000001f0  The address is mrec \u002B 0x18, i.e. mft_record.bytes_in_use, and the change is the 96 bytes of one $FILE_NAME attribute being removed.  Keep base_ni-\u003Emrec_lock from the resident read iomap lookup through iomap_end(). This protects both the attribute walk and the subsequent copy from iomap-\u003Einline_data, which points into the MFT record. The non-resident path is left alone: ntfs_lookup() already holds the directory inode\u0027s mrec_lock when it reads an index folio through read_mapping_folio(), and taking the lock in the shared wrapper deadlocks there with recursive locking on mrec_lock. The comment above the read_mapping_folio() call in fs/ntfs/dir.c notes the same hazard.  The seek path uses the same lookup helper but does not dereference iomap-\u003Einline_data. Release the lock before returning from that path, whereas the regular read path records base_ni in iomap-\u003Eprivate and releases the lock from its iomap_end() callback.  Tested with a reproducer that faults in a 16-byte resident file while another thread runs link()/unlink() on it. Before: 40 KCSAN reports in about one second. After: no reports in 180 seconds over 206,090 read iterations and 423,540 link/unlink cycles. A PROVE_LOCKING build shows no lockdep splat with the same reproducer running for 60 seconds.",
  "published": "2026-09-17T17:17:05Z",
  "severity": "high",
  "cvss": 7.1,
  "cvssVector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
  "epss": 0.00156,
  "epssPercentile": 0.048,
  "priority": "High",
  "priorityTier": 3,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 14",
      "fixedVersion": "7.2.6-1",
      "fix": "DEBIAN-CVE-2026-90131",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-90131",
      "released": "2026-09-23T19:19:02Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T19:12:23Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}