{"id":28686,"date":"2026-09-25T04:31:35","date_gmt":"2026-09-24T20:31:35","guid":{"rendered":"https:\/\/www.54iter.cn\/?vuln=cve-2026-97439"},"modified":"2026-09-25T04:31:35","modified_gmt":"2026-09-24T20:31:35","slug":"cve-2026-97439","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-97439","title":{"rendered":"CVE-2026-97439 &#8211; In the Linux kernel, the following vulnerability has been resolved:\n\nfs\/ntfs3: preserve no"},"content":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>fs\/ntfs3: preserve non-DOS attribute bits in system.dos_attrib<\/p>\n<p>[BUG]<br \/>\nA corrupted ntfs3 image can hit a NULL function pointer call in<br \/>\ngeneric_perform_write() after toggling system.ntfs_attrib and then<br \/>\noverwriting system.dos_attrib on the same file.<\/p>\n<p>BUG: kernel NULL pointer dereference, address: 0000000000000000<br \/>\n#PF: supervisor instruction fetch in kernel mode<br \/>\n#PF: error_code(0x0010) &#8211; not-present page<br \/>\nPGD bed5067 P4D bed5067 PUD 0<br \/>\nOops: Oops: 0010 [#1] SMP KASAN NOPTI<br \/>\nRIP: 0010:0x0<br \/>\nCode: Unable to access opcode bytes at 0xffffffffffffffd6.<br \/>\nRSP: 0018:ffff88801025f988 EFLAGS: 00010246<br \/>\nCall Trace:<br \/>\n generic_perform_write+0x409\/0x8c0 mm\/filemap.c:4255<br \/>\n __generic_file_write_iter+0x1bb\/0x200 mm\/filemap.c:4372<br \/>\n ntfs_file_write_iter+0xcd9\/0x1c20 fs\/ntfs3\/file.c:1253<br \/>\n new_sync_write fs\/read_write.c:593 [inline]<br \/>\n vfs_write+0x63b\/0xf70 fs\/read_write.c:686<br \/>\n ksys_write+0x133\/0x250 fs\/read_write.c:738<br \/>\n __do_sys_write fs\/read_write.c:749 [inline]<br \/>\n __se_sys_write fs\/read_write.c:746 [inline]<br \/>\n __x64_sys_write+0x77\/0xc0 fs\/read_write.c:746<br \/>\n &#8230;<\/p>\n<p>[CAUSE]<br \/>\nsystem.ntfs_attrib updates ATTR_DATA flags via ni_new_attr_flags()<br \/>\nand switches i_mapping-&gt;a_ops to ntfs_aops_cmpr when<br \/>\nFILE_ATTRIBUTE_COMPRESSED is set. system.dos_attrib then overwrites<br \/>\nni-&gt;std_fa from a one-byte DOS attribute value, clearing the compression<br \/>\nbit without updating ATTR_DATA or the mapping operations.<\/p>\n<p>Old buffered writes use is_compressed(ni) to choose<br \/>\n__generic_file_write_iter(). That leaves generic_perform_write() calling<br \/>\na NULL write_begin callback from ntfs_aops_cmpr.<\/p>\n<p>[FIX]<br \/>\nTreat system.dos_attrib as a low-byte DOS attribute update and preserve the<br \/>\nexisting non-DOS attribute bits in ni-&gt;std_fa. This keeps compressed and<br \/>\nsparse state consistent with ATTR_DATA and the mapping operations while<br \/>\nkeeping the existing DOS attribute semantics intact.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>fs\/ntfs3: preserve non-DOS attribute bits in system.dos_attrib<\/p>\n<p>[BUG]<br \/>\nA corrupted ntfs3 image can hit a NULL function pointer call <\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-28686","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/28686","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=28686"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=28686"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=28686"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}