CVE-2026-99241

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> ntfs: take invalidate_lock in ntfs_filemap_page_mkwrite()<br /> <br /> ntfs_filemap_page_mkwrite() calls iomap_page_mkwrite() without holding<br /> mapping-&gt;invalidate_lock, so a concurrent truncate or fallocate can be<br /> in the middle of invalidating pagecache and rewriting the runlist while<br /> the write fault maps blocks and dirties the folio. This races with<br /> ntfs_attr_fallocate(), which merges clusters into the in-memory<br /> runlist, drops the runlist lock, and only afterwards zeroes the newly<br /> allocated clusters on disk; and with the punch-hole/insert/collapse<br /> paths that free clusters after truncating the cache.<br /> <br /> Per Documentation/filesystems/locking.rst, -&gt;page_mkwrite() must ensure<br /> there are no truncate/invalidate races, "usually mapping-&gt;invalidate_lock<br /> is suitable for proper serialization". xfs takes its mmaplock (= the<br /> invalidate_lock rwsem) shared in exactly this path.<br /> <br /> Take invalidate_lock shared around iomap_page_mkwrite(). The read-only<br /> fault path is already covered because filemap_fault() itself grabs<br /> invalidate_lock shared on instantiation/read paths; only page_mkwrite<br /> was bypassing it in this driver.