CVE-2026-98138: Linux kernel · ntfs: do not mark the volume clean in sync_fs when errors were recorded
Affects Linux kernelSource CVE Database V5
Not known to be exploited : upgrade to ca1f9933eff777a604eb664d0f9ae433b8664cbf or 0e4c839905418d55bafe571a92533a1d1ac7b0a8 when convenient.
Data as of 26 Oct 2026, 13:47 UTC
Rated Medium by Threat Radar's AI analysis · CVSS not yet scored by NVD
- EPSS
- 0.1% chance of exploitation in 30 days – higher than 0% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
- Patch
- Available – fixed in ca1f9933eff777a604eb664d0f9ae433b8664cbf, 0e4c839905418d55bafe571a92533a1d1ac7b0a8
Exploitation evidence
Disclosed: evidence found.
CVE published 25 Sep 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
Upgrade Linux kernel to ca1f9933eff777a604eb664d0f9ae433b8664cbf or 0e4c839905418d55bafe571a92533a1d1ac7b0a8.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in– |
AI-suggested
A fix is available in the Linux kernel versions identified by commits ca1f9933eff777a604eb664d0f9ae433b8664cbf and 0e4c839905418d55bafe571a92533a1d1ac7b0a8. Users should update to a kernel version including these fixes to ensure proper handling of NTFS volume errors and recovery.
Description
A vulnerability in the Linux kernel's NTFS driver caused the volume to be incorrectly marked as clean after errors were recorded, preventing necessary recovery operations. The issue was that ntfs_sync_fs() cleared the dirty bit unconditionally, even when volume errors existed, leading to volumes not undergoing repair after errors. The fix ensures the dirty bit is not reset if volume errors are present, preserving the need for recovery.