CVE-2026-98880None▾ SunlitIn the Linux kernel, the following vulnerability has been resolved: ntfs3: handle set_blocksize failures ntfs3 uses buffer_heads, which don't handle block size > PAGE_SIZE well. Without this, mounting we will hit the BUG_ON(of…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 2.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
In the Linux kernel, the following vulnerability has been resolved:
ntfs3: handle set_blocksize failures
ntfs3 uses buffer_heads, which don't handle block size > PAGE_SIZE well. Without this, mounting we will hit the
BUG_ON(offset >= folio_size(folio));
in folio_set_bh on the first __bread_gfp call.
Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < df9dac4dbe557f6455a61e68cc09ef98b22f3686Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < c5b8a7ec9a0a71518915c82b8552be1ccbb88288Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 78e10082f3e919b8863958feac5f269d3ade9469Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 24f7d1824b7581ae3daf9d443c5dfeabd89df6d8Linux < 6.6.158Linux < 6.12.111Linux < 6.18.53Linux (all versions)Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-99001Nonedrm/xe/i2c: cancel the client work on remove
CVE-2026-98989Nonenamespace: check a recursive bind mount for mount namespace loops
CVE-2026-98988Nonenamespace: keep covered mounts covered in OPEN_TREE_NAMESPACE
CVE-2026-98992Nonenamespace: don't copy an unmounted mount tree
CVE-2026-98991Nonenamespace: queue a mount only once for mount notifications
CVE-2026-98990Nonenamespace: check a submount for references right before unmounting it