VulnerabilityPublished 28 Oct 2026

CVE-2026-99108: Linux kernel · ntfs: fix FITRIM range alignment

Affects Linux kernelSource CVE Database V5

Not known to be exploited : upgrade to 5e87da8ba8d3d647d89c754912e45c1f1a3bfc2e or 03c6ecc4b4b13a3901f207152451fdd2d82e40c4 when convenient.

Data as of 28 Oct 2026, 10:58 UTC

Severity

Unrated

Rated by Threat Radar · CVSS not yet scored by NVD

Patch: Available – fixed in 5e87da8ba8d3d647d89c754912e45c1f1a3bfc2e, 03c6ecc4b4b13a3901f207152451fdd2d82e40c4

Exploitation evidence

Disclosed: evidence found.
CVE published 28 Oct 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Upgrade Linux kernel to 5e87da8ba8d3d647d89c754912e45c1f1a3bfc2e or 03c6ecc4b4b13a3901f207152451fdd2d82e40c4.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected ≥ 11ccc9107dc460de28af90fac1f42404d9802735, < 5e87da8ba8d3d647d89c754912e45c1f1a3bfc2e	Fixed in 5e87da8ba8d3d647d89c754912e45c1f1a3bfc2e
LinuxLinux	Affected ≥ 11ccc9107dc460de28af90fac1f42404d9802735, < 03c6ecc4b4b13a3901f207152451fdd2d82e40c4	Fixed in 03c6ecc4b4b13a3901f207152451fdd2d82e40c4
LinuxLinux	Affected =7.1	Fixed in–

Description

In the Linux kernel, the following vulnerability has been resolved: ntfs: fix FITRIM range alignment ntfs_trim_fs() aligns the start of a free extent up to the device discard granularity, but derives the discard length by aligning the original extent length down. When the free extent start is not discard-aligned, adding that length to the aligned start can extend the discard past the free extent and into allocated clusters. For example, with 4 KiB clusters and 32 KiB discard granularity, the free extent [4 KiB, 36 KiB) becomes the discard range [32 KiB, 64 KiB), so 28 KiB beyond the free extent may be discarded. Align the absolute end of the free extent down and derive the length from the two aligned endpoints. Skip extents that contain no full discard unit. Reproduced with a 4 KiB-cluster NTFS filesystem on scsi_debug configured for 32 KiB discard granularity and read-zero-after-trim. Before this change, FITRIM zeroed seven allocated 4 KiB clusters following an unaligned 32 KiB hole. With this change, the same data remains intact across FITRIM and remount.

References

Community reviews

Loading reviews…