CVE-2026-98133: Linux kernel · ntfs: leave HasEA flag untouched on setxattr failure
Affects Linux kernelSource CVE Database V5
Not known to be exploited : upgrade to ac727d86fb84bdc9626ba9c756c26767459f3083 or 5811a08310754cbf4a1122c81d14c54b8873c35c when convenient.
Data as of 26 Oct 2026, 17:16 UTC
Rated Low by Threat Radar's AI analysis · CVSS not yet scored by NVD
- EPSS
- 0.1% chance of exploitation in 30 days – higher than 1% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
- Patch
- Available – fixed in ac727d86fb84bdc9626ba9c756c26767459f3083, 5811a08310754cbf4a1122c81d14c54b8873c35c
Exploitation evidence
Disclosed: evidence found.
CVE published 25 Sep 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
Upgrade Linux kernel to ac727d86fb84bdc9626ba9c756c26767459f3083 or 5811a08310754cbf4a1122c81d14c54b8873c35c.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in– |
AI-suggested
A fix is available in the Linux kernel versions identified by commit hashes ac727d86fb84bdc9626ba9c756c26767459f3083 and 5811a08310754cbf4a1122c81d14c54b8873c35c. Users and administrators should update to a Linux kernel version that includes these fixes to resolve the issue.
Description
A vulnerability in the Linux kernel's NTFS implementation causes the HasEA flag to be incorrectly updated on setxattr failure. This can hide existing on-disk extended attributes (EAs) until the inode is evicted. The issue occurs because the flag is updated unconditionally even when an error happens before the EA size is updated. The fix ensures the flag is only updated on successful operations.